DOMPurify vulnerable to tampering by prototype pollution
CVE: CVE-2024-48910
Component: dompurify
CWE: CWE-1321
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Release date: 2024-10-31T14:22:52.867000+00:00

A prototype pollution vulnerability was found in DOMPurify. This flaw allows a remote attacker to add or modify attributes of an object prototype. This issue can lead to the injection of malicious attributes used in other components or cause a crash by overriding existing attributes with ones of incompatible type.

Statement: The prototype pollution vulnerability in DOMPurify is considered a high-severity issue because it allows attackers to modify the prototype of built-in JavaScript objects, potentially impacting the entire application. This could lead to security risks, such as overwriting methods on fundamental objects like `Object`, `Array`, or `Function`, allowing attackers to manipulate application behavior, bypass security controls, or cause application crashes. Given that DOMPurify is a core library for sanitizing user input, an attacker exploiting this vulnerability could gain control over how sanitized content is processed, leading to the execution of malicious scripts or triggering other unintended behaviors across the application.

Remediation:
If you are using an earlier version of RHACS 4.4, you are advised to upgrade to this patch release 4.4.6.
If you are using an earlier version of RHACS 4.5, you are advised to upgrade to this patch release 4.5.5.
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:f4c6252655cea21b790ab6bd8d88da9a657d787a365cedf79bcab8371eb11290

      (For s390x architecture)
      The image digest is sha256:b7a9b6bebff381cd86dd38747a43045fba0f2ff1903c87ac551d7cada723ebcb

      (For ppc64le architecture)
      The image digest is sha256:6823347a606e8ea4e08708bbc8ca3fefa60f3b2659d86478885b6f7405baf14b

      (For aarch64 architecture)
      The image digest is sha256:870cc14058a63d173f50f7a2f8d0140e48e6f283bc8521584f1e73002cc17d5f

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:ae82d76cd15164a68c1762d5deb6aa53cc0b0b436e2d6429d8503e7a5d5c6780

      (For s390x architecture)
      The image digest is sha256:68602e06425f94f0489f4bb9cb2e3b0248a4a34d4e11db73c6a9819d631de695

      (For ppc64le architecture)
      The image digest is sha256:aa2d12a6002cdd0146da5a528b24caca832a2c5b93ca43536c2604a0c88e85db

      (For aarch64 architecture)
      The image digest is sha256:1740ed2fc124d84e6d2470b8cd819882a3c79a30f8922bdfd91c3a5e86fcdfe8

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:d26fd3fd30ac6ae13f2779045d4e2defbf77aa24db5393d91df19488fd42504d




All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:384dcc2b7dde97674e4197b6e4130268adc2b00a94908aa9220a4061aa1030ac

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:3f2d4bc82096d5d4d5655e9182b65cdfcf2f33d0f22d07e2fa21c6b3a6132421

      (For s390x architecture)
      The image digest is sha256:25df19fb167c97561e114121ff0de951cd92915c0d0e6a52690a24a23f3bcc19

      (For ppc64le architecture)
      The image digest is sha256:4909f684ff0524395ff7a3624e4e75055069c777d7a4249c31bf66ac2d6f873f

      (For aarch64 architecture)
      The image digest is sha256:5264a4a46541af0486035968b76d041dc0b86e9269d9c33168ab1bb553a2c870

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:855c4f8fd6db0a6c7b7ae0f0e02ca5b51720cbac0911725963fa7bc63b943d21

      (For s390x architecture)
      The image digest is sha256:fb218aff20519c10a13f3571cf47aa56ec2363b2dfc06a93e6b8a31f391cd4ac

      (For ppc64le architecture)
      The image digest is sha256:8b7fd6407a406163268297557db03eafebd2ad18927dbbaaa82a5ace028a7076

      (For aarch64 architecture)
      The image digest is sha256:be872deb5923ccf88e32c0ec9422982159f53ee4d547b4ea59a165266d4d2ab2

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:49d83378f39afe7f13c1db8f46cbf757ddcc84f16737a2e6d8eacb1f2004afd0

      (For s390x architecture)
      The image digest is sha256:c980b26aa7567bdeae8e57d2f0563d02a872fc1db58c5b04cf763db996baf2f6

      (For ppc64le architecture)
      The image digest is sha256:4fd7b631a65b0693adbc5de765029c3940986774cb272a28ad0ebf5efc0e51cc

      (For aarch64 architecture)
      The image digest is sha256:ede922bb388be2155274002c5f88d755e36200f259706299e5cd3a3bd89bd0cc

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:8f7bac89fde3605d5a9deb078b1c72c213d5250ae1a6d32906e529fb99b94cc1

      (For s390x architecture)
      The image digest is sha256:e330780dcc62d489ac534c4f752da3500344aae19c47aece6b9ed2bb07162563

      (For ppc64le architecture)
      The image digest is sha256:78951635172ff7d338b4e3d1ecee0d7751af9588bd90e44d2840dcb64618519d

      (For aarch64 architecture)
      The image digest is sha256:04ecf33d27c9e8fbed1054d3370d7f1d853341daf4ad688174ae25f6e257bfb4

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:4686c8d26194f890c2a241271d41a762d4be26af0be60e9cfd0c563f61b3beab

      (For s390x architecture)
      The image digest is sha256:347f519159ec36a0484e62ecddab7b5aaa3259eda7bb03c3fb3b295ce999d380

      (For ppc64le architecture)
      The image digest is sha256:004463644cdeb879134cf7b0c59f55d7ae74694d6580fc6dedf05d0c51c5561b

      (For aarch64 architecture)
      The image digest is sha256:1045c0fdb163990ee75ad950c1a2760b8b22bf8616a32bafad5517bbd93c0219

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:5c01281c55d75a1569440f91d2708125f14533c675b96d7be67b7a1badd759e5

      (For s390x architecture)
      The image digest is sha256:0c074415a88f397ba85f0dc8197873a8813129f6b118149ae90bca9f0e3a5738

      (For ppc64le architecture)
      The image digest is sha256:612f9ea458fe4e6851b40067ac43f8beea076acab6da6b0cd7170633c35bbf3b

      (For aarch64 architecture)
      The image digest is sha256:0c87062705df7714809c16ea2f94123ee9cbeafc320ca9c45ddc29b6c1f568b0

All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:cbde13fe6ed4db88796be201fbdb2bbb63df5763ae038a9eb20bc793d5740416

      (For s390x architecture)
      The image digest is sha256:7ebf9b89942c0619685427117c5dcb9fc3ea3ce7fc48b878a37d620391332d5e

      (For ppc64le architecture)
      The image digest is sha256:6cdcf883799d2f97a7df564d732ea6226bed846bfd62cab55f224dbee02796f2

      (For aarch64 architecture)
      The image digest is sha256:29326919cd265074e9aaf16a57b817d3430d0504ab4ef96a8d9b273ee666f508

All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.