RHBA-2024:3555MediumCVSS 7.5

Red Hat Bug Fix Advisory: multicluster engine for Kubernetes 2.4.5 bug fixes and container updates

Published
June 3, 2024
Last Modified
August 19, 2026

🔗 CVE IDs covered (4)

CVE-2023-26159 →CVE-2024-4068 →CVE-2024-21501 →CVE-2024-28176 →

📋 Description

CVE-2023-26159 — follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() CVE-2024-4068 — braces: fails to limit the number of characters it can handle CVE-2024-21501 — sanitize-html: Information Exposure when used on the backend CVE-2024-28176 — jose: resource exhaustion

🎯 Affected products165

  • multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/addon-manager-rhel8@sha256:503ddfb076790268989301a0eef88c47eee91cd773e1167c7cd79095db87d321_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/addon-manager-rhel8@sha256:65ab3547a8df2565f86753d569e27c7b57f379262c6a063e3537b6bfe0a8c3ac_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/addon-manager-rhel8@sha256:876e6b81fddd73d6f2a5d493849fddbaaa831ea57ba6221c9af25ea0faaebc7e_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/addon-manager-rhel8@sha256:c1951db18fb67a81cb74ca9b868190a8dbc82a3e7273151056264c4dad193c89_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:4253351f41397c9a84720de93734e253f1cca1137dbc71237e454064cd17094d_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:56e9c7bf17a97d5fc008be6f48726b07f4ea9b9a3711d47509ff3bfb3af84d90_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:58d2befa5f997e5f02d119e71953294d6ac10fcc1e71c07cdddae59b5665db74_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:7e55748729c24ad707116e73c2db8839ba8e7a5bd37d18ba12d4bd0b81771a75_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:9083802fefbd52db5f8e45106fbc9984f1567d51c049db66367f12b7a3c28cd3_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:b37a125efc976cddd0116de2d1fb08116973e82b1d8474f01c8681af504e4f62_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:d81d237c59e5fde268b5324825c6ed34ca9b31c32bea12ff53f6d9452efcd388_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:eea0b25a912485674ec9b7eedca88a2f3712abb56658c6333bdfe2a19c35668f_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:31ee1778cbaa4b3dfbf27b95d58988e206559dbc707bdd01a99aec72984b7a8f_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:33428302a2ea21a505186de7bcd1db6e43294e7ce0ac10cb094b4c79a9d4ab4e_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:9efec386fb6b539a3c5c9d7d7ddac86b9eeabae2428b042c095298971dbe1744_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:ba2b931f73225923ee4dbaa96eaee3b89d394540b4e5da89e7c538f1cff84dc3_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:61e8590979a7b10dad68c62c082eb79dc7f0379646485b339bbe87efd5dc1281_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:735c7c32f0cbe4c077dffa8ef4a1c4d54dbe7c18e40698cb3311c3250e001218_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:c6ac38eafe30d5dca1d84816186962ad2170cfeb85dfa0631d83275bedc6b7d7_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:fffca3cde0cf40577c16d7df4a3c8d92036d89b960f0b18f4eb016345c606101_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:2cf7c31fdce3dc1c2591baf0354df95d3e7fc380e35d2adc4faee7c3baa14a6e_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:9385d82e7803fc9f0451fb8b8036c29205db67b16e0f4b51c72d05027f0071da_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:c8fcf3c5f2bb9e82c6715113bbdacba0ddcccd2896edaca11d1c5856c5e9baa9_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:ce54ba2d1ead6c539d8b2917a2de7bec3c5edd2bbf6556295276068b1e762603_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:4254be09b49d6d49fd2f47fcd339cf5069c93210ea1adbf1875481455b4fa68c_arm64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:475b831f930f1f8b490ca602ebdcd3e98208505603c12be891177cceb3afbadf_amd64 as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:8bf8a9711cc07286993aeabfde47cf74e52eb6ae24f5928b75bca37c84a0bdd1_s390x as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:ee93404b6ca9329b843a08290f81dc61b9a55862a30ef305b9aca18352cbcf8f_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:19be54b47e27503befc1e44a8544bebd778e634f65769559772309bcbddd05e5_ppc64le as a component of multicluster engine for Kubernetes 2.4 for RHEL 8
  • +135 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html/clusters/cluster_mce_overview#installing-while-connected-online-mce Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (4)