Red Hat Updates OpenShift Products for Express Redirect and path-to-regexp ReDoS Flaws

Red Hat issued security updates for OpenShift and related products to remediate CVE-2024-45296 in path-to-regexp and CVE-2024-43796 in Express.js. The path-to-regexp flaw permits regular-expression denial of service when a crafted route pattern places two parameters in one path segment separated by a non-period character, potentially blocking Node.js's single-threaded event loop. Express versions before 4.20.0 can improperly handle untrusted input passed to response.redirect(), potentially enabling execution of untrusted code even when the input has been sanitized.

Affected updates include OpenShift Data Foundation 4.14.13, 4.15.9, and 4.17.0 container images, as well as OpenShift Container Platform 4.17 releases and other Red Hat offerings such as OpenShift Service Mesh, Serverless, OpenShift AI, Dev Spaces, Network Observability, and the Red Hat build of Apache Camel. The advisories also address additional bundled-component flaws, including prototype pollution, unsafe redirects, DOM clobbering, resource exhaustion, and potential code execution. Administrators should apply the applicable Red Hat errata and upgrade path-to-regexp to 0.1.10 on the 0.1 branch or 8.0.0 on other branches, and Express to 4.20.0 or later.