CVE-2023-37466

vm2 es una máquina virtual/sandbox avanzada para Node.js. La librería contiene problemas de seguridad críticos y no debe usarse para producción. El mantenimiento del proyecto ha sido descontinuado. En vm2 para versiones hasta 3.9.19, la sanitización del controlador `Promise` se puede omitir con la propiedad de acceso `@@species`, lo que permite a los atacantes escapar del entorno limitado y ejecutar código arbitrario, lo que potencialmente permite la ejecución remota de código dentro del contexto del entorno limitado de vm2.

A flaw was found in the vm2 Promise handler sanitization, which allows attackers to escape the sandbox. This flaw allows attackers to run arbitrary code.

Red Hat Advanced Cluster Management for Kubernetes 2.8.1 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide security updates and fix several bugs. Issues addressed include bypass and privilege escalation vulnerabilities.