Red Hat Updates OpenShift Products for Send Code Execution and Webpack XSS

Red Hat released Important security updates for OpenShift Service Mesh Containers 2.5.5 and 2.6.2 and OpenShift Serverless Logic 1.34.0, remediating flaws in bundled Node.js and infrastructure components. The updates address CVE-2024-43799 in the send library, where untrusted input passed to SendStream.redirect() can result in untrusted code execution, and CVE-2024-43788 in Webpack's AutoPublicPathRuntimeModule, a DOM-clobbering flaw that can enable XSS when attackers can inject insufficiently sanitized scriptless HTML elements with name or id attributes.

The Service Mesh advisories also fix issues in serve-static, Express, body-parser, Envoy, path-to-regexp, and libcurl, including denial-of-service conditions, unsafe redirects, regular-expression DoS, log injection, externally manipulable x-envoy headers, Envoy crashes, and a libcurl ASN.1 date-parser overread. The Serverless Logic update additionally addresses axios SSRF and input-sanitization issues and an unbounded Vert.x gRPC message-size condition. Affected deployments span RHEL 8 on x86_64, ARM64/aarch64, ppc64le, and s390x where applicable; Red Hat recommends applying relevant prior errata before deploying the updates.