RHSA-2024:8694: Red Hat OpenShift 4.12 Security Update Fixing Multiple CVEs

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: RHSA-2024:8694 2. Release Date: November 7, 2024 3. Update Date: November 7, 2024 4. Type/Severity: Security Advisory, Important 5. Subject: Red Hat OpenShift Container Platform 4.12.68 Security Update 6. Description: - Red Hat OpenShift Container Platform 4.12.68 is now available, including updates to packages and images that fix several bugs and add enhancements. - Contains security updates for Red Hat OpenShift Container Platform 4.12. - Red Hat Product Security has rated the severity of this update as Important. 7. Affected Products: - Red Hat OpenShift Container Platform 4.12 for RHEL 9 x86_64 - Red Hat OpenShift Container Platform 4.12 for RHEL 8 x86_64 - Red Hat OpenShift Container Platform for Power 4.12 for RHEL 9 ppc64le - Red Hat OpenShift Container Platform for Power 4.12 for RHEL 8 ppc64le - Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.12 for RHEL 9 s390x - Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.12 for RHEL 8 s390x - Red Hat OpenShift Container Platform for ARM 64 4.12 for RHEL 9 aarch64 - Red Hat OpenShift Container Platform for ARM 64 4.12 for RHEL 8 aarch64 8. Fixes: - BZ-2309331 - CVE-2024-44082 openstack-ironic: A specially crafted image may allow an authenticated user to access potentially sensitive data. - BZ-2310527 - CVE-2024-34155 go/parser: golang: Calling any parsing function with deeply nested structures can lead to stack exhaustion. - BZ-2310528 - CVE-2024-34156 encoding/gob: golang: Calling Decoder.Decode with strings embedded in messages can lead to stack exhaustion. - BZ-2310529 - CVE-2024-34158 go/build/constraint: golang: Calling Parse with deeply nested expressions on “// +build” build tag lines can lead to stack exhaustion. - BZ-2315691 - CVE-2024-9341 Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library - BZ-2317467 - CVE-2024-9676 Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) 9. CVEs: - CVE-2024-9341 - CVE-2024-9676 - CVE-2024-34155 - CVE-2024-34156 - CVE-2024-34158 - CVE-2024-44082 This information provides detailed descriptions of the vulnerabilities, a list of affected products, remediation measures, and associated CVE numbers, aiding in understanding and addressing the security issues outlined in this advisory.

Goal Reached Thanks to every supporter — we hit 100%!

RHSA-2024:8694: Red Hat OpenShift 4.12 Security Update Fixing Multiple CVEs

More from this source