VDB
RHBA-2024%3A4458
RHBA-2024%3A4458
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the NPM package `braces.` It fails to limit the number of characters it can handle, which could lead to memory exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, causing the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | multicluster-engine/must-gather-rhel9@sha256:c9cd4fbb673eb65c2c49bb67052c9cb54534cd5a6c80b1fb87736e5fe13a1d89_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/must-gather-rhel9@sha256:c9cd4fbb673eb65c2c49bb67052c9cb54534cd5a6c80b1fb87736e5fe13a1d89_ppc64le |
| Red Hat | multicluster-engine/registration-operator-rhel9@sha256:bc3ba4dce77c6d549b93dca61e987d11d4de58a97a801439bbb00a746a090a2d_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/registration-operator-rhel9@sha256:bc3ba4dce77c6d549b93dca61e987d11d4de58a97a801439bbb00a746a090a2d_arm64 |
| Red Hat | multicluster-engine/assisted-image-service-rhel8@sha256:d902f882d7537f2c1f1565344e6d030488903d56e57292010ff51414d448388a_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | * |
| Red Hat | multicluster-engine/registration-rhel9@sha256:b079596196938139a6e6c44cbcd374c9e796b23be3d4b9568dcc30376cd7049e_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/registration-rhel9@sha256:b079596196938139a6e6c44cbcd374c9e796b23be3d4b9568dcc30376cd7049e_arm64 |
| Red Hat | multicluster-engine/hypershift-cli-rhel9@sha256:562c4f7d28725314b8b4de5245cb239c946f07fcf4a8786042d41dc8be6b0948_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/hypershift-cli-rhel9@sha256:562c4f7d28725314b8b4de5245cb239c946f07fcf4a8786042d41dc8be6b0948_arm64 |
| Red Hat | multicluster-engine/managed-serviceaccount-rhel9@sha256:ce1d39f85b348f5a736b2bd2bbebb173c70a296b955972bbc41947bd8ba9da7d_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | * |
| Red Hat | multicluster-engine/aws-encryption-provider-rhel9@sha256:8e077ea09d0605a3a9e096213ad56cb6c7455b19ab443bbef4f171b5faa08032_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | * |
| Red Hat | multicluster-engine/multicluster-engine-console-mce-rhel9@sha256:a6e516b658a6efd46fdd0ea8531041e763c418282e9320f4876f0865030580e5_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/multicluster-engine-console-mce-rhel9@sha256:a6e516b658a6efd46fdd0ea8531041e763c418282e9320f4876f0865030580e5_ppc64le |
| Red Hat | multicluster-engine/assisted-installer-agent-rhel8@sha256:102d423ee21b40bb0f881f8670d093eecc8cd2517205f768ed12fb22102bce00_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | * |
| Red Hat | multicluster-engine/assisted-installer-reporter-rhel8@sha256:4f0205030b6c3857e5e71e032de3b039f033abff889e5585a0c3bc7e66df5a12_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | * |
| Red Hat | multicluster-engine/agent-service-rhel8@sha256:fc1c33a8173a2fbb2235fe78ee0cd269c68a9cffddf1827f93f185e4fd23074c_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | multicluster-engine/agent-service-rhel8@sha256:fc1c33a8173a2fbb2235fe78ee0cd269c68a9cffddf1827f93f185e4fd23074c_arm64 |
| Red Hat | multicluster-engine/cluster-curator-controller-rhel9@sha256:c8266a547f30a65c3ca10a1b9d5cd9703fb37706640073994947c4f8af1e79a8_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/cluster-curator-controller-rhel9@sha256:c8266a547f30a65c3ca10a1b9d5cd9703fb37706640073994947c4f8af1e79a8_s390x |
| Red Hat | multicluster-engine/assisted-installer-reporter-rhel8@sha256:684afbdb75f6848932d4e2635eff17e9877b4ebfd59e853bc6004b05ae2cff95_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | multicluster-engine/assisted-installer-reporter-rhel8@sha256:684afbdb75f6848932d4e2635eff17e9877b4ebfd59e853bc6004b05ae2cff95_s390x |
| Red Hat | multicluster-engine/cluster-api-provider-azure-rhel9@sha256:ccafc1e4bbdd3bd6e0701e7904d05bf594489e223f8f711d73382673ca0ce9ff_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/cluster-api-provider-azure-rhel9@sha256:ccafc1e4bbdd3bd6e0701e7904d05bf594489e223f8f711d73382673ca0ce9ff_arm64 |
| Red Hat | multicluster-engine/hive-rhel8@sha256:06e2ea86d37a0acfbcc111ed9891b61225d02a6a2189651d2938c7ae31a96164_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | multicluster-engine/hive-rhel8@sha256:06e2ea86d37a0acfbcc111ed9891b61225d02a6a2189651d2938c7ae31a96164_ppc64le |
| Red Hat | multicluster-engine/cluster-api-provider-agent-rhel9@sha256:1320fb20dd728cc91b651b3898e861b3c7c5386bdc071c6d059e3baa2df48547_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/cluster-api-provider-agent-rhel9@sha256:1320fb20dd728cc91b651b3898e861b3c7c5386bdc071c6d059e3baa2df48547_s390x |
| Red Hat | multicluster-engine/managed-serviceaccount-rhel9@sha256:ce1d39f85b348f5a736b2bd2bbebb173c70a296b955972bbc41947bd8ba9da7d_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/managed-serviceaccount-rhel9@sha256:ce1d39f85b348f5a736b2bd2bbebb173c70a296b955972bbc41947bd8ba9da7d_ppc64le |
| Red Hat | multicluster-engine/image-based-install-rhel9@sha256:2327037bf6a7af3c57c71aa0e8b314d90c024fbf533f945f70933e44a1720fbd_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/image-based-install-rhel9@sha256:2327037bf6a7af3c57c71aa0e8b314d90c024fbf533f945f70933e44a1720fbd_s390x |
| Red Hat | multicluster-engine/assisted-installer-rhel8@sha256:b66aedd62f8860eff543ab356fe697be04ea80bce46b5f3bf8a11a52a341d796_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | * |
| Red Hat | multicluster-engine/discovery-rhel9@sha256:c0155da00c12f7a07efe794025bffed1a3db5ae0357d0b38bc0f889e294dec10_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/discovery-rhel9@sha256:c0155da00c12f7a07efe794025bffed1a3db5ae0357d0b38bc0f889e294dec10_amd64 |
…and 316 more
Timeline
- Jul 10, 2024 CVE Published
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHBA-2024:4458 advisory
- https://issues.redhat.com/browse/ACM-12584 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_4458.json advisory
- https://access.redhat.com/security/cve/CVE-2024-4068 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2280600 issue
- https://www.cve.org/CVERecord?id=CVE-2024-4068 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-4068 advisory
- https://devhub.checkmarx.com/cve-details/CVE-2024-4068/ advisory
- https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308 advisory
- https://github.com/micromatch/braces/issues/35 advisory