Migration Toolkit for Runtimes 1.2.6 release
Red Hat Product Security has rated this update as having a security impact of
 Important.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed
 severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Migration Toolkit for Runtimes 1.2.6 Images

Security Fix(es):

* undertow: Cookie Smuggling/Spoofing (CVE-2023-4639)
* jetty: Improper addition of quotation marks to user inputs in CgiServlet
 (CVE-2023-36479)
* css-tools: Improper Input Validation causes Denial of Service via Regular
 Expression (CVE-2023-26364)
* css-tools: regular expression denial of service (ReDoS) when parsing CSS
 (CVE-2023-48631)
* keycloak: path transversal in redirection validation (CVE-2024-1132)

For more details about the security issue(s), including the impact, a CVSS
 score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-4639: Inconsistent Interpretation of HTTP Requests ('HTTP
 Request/Response Smuggling') (CWE-444)
CVE-2023-26364: Improper Input Validation (CWE-20)
CVE-2023-36479: Improper Neutralization of Quoting Syntax (CWE-149)
CVE-2023-48631: Inefficient Regular Expression Complexity (CWE-1333)
CVE-2024-1132: Improper Limitation of a Pathname to a Restricted Directory
 ('Path Traversal') (CWE-22)