RHEA-2024:7870HighCVSS 7.5

Red Hat Enhancement Advisory: Red Hat OpenShift Pipelines Operator Bundle 1.16.0 release

Published
October 9, 2024
Last Modified
August 15, 2026

🔗 CVE IDs covered (4)

CVE-2024-29041 →CVE-2024-29180 →CVE-2024-39338 →CVE-2024-28863 →

📋 Description

CVE-2024-28863 — node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-29041 — express: cause malformed URLs to be evaluated CVE-2024-29180 — webpack-dev-middleware: lack of URL validation may lead to file leak CVE-2024-39338 — axios: axios: Server-Side Request Forgery

🎯 Affected products113

  • OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-chains-controller-rhel8@sha256:6b3e1fb2d534596e811290912f44adc7e802f0b9221fdf99c040804741be51f4_s390x as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-chains-controller-rhel8@sha256:97f4b5fe34f39729a6e5b0dae6992788e707e400bf5e0c7f6ef9e0a1751ffd81_amd64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-chains-controller-rhel8@sha256:abb7268ee2ce62b94b4dba0fc65207bcc7ac64338b10d15ccc57a0b077c56d5e_ppc64le as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-chains-controller-rhel8@sha256:d0e21023ff258a92b2b899089ac8245f6a7aaedf72596dd952bc6bc2072f07eb_arm64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-cli-tkn-rhel8@sha256:5fcd0a7266ebb30fcb6522de7d46185f3c4effcf7aed2bdff9133180d8092e81_amd64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-cli-tkn-rhel8@sha256:a9308b73e38d1784e7e0e85530494811a3a936581b0b15406a831cbca6b51d4d_ppc64le as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-cli-tkn-rhel8@sha256:d740f317b2fd15a7fdb8b5461bc3ee13d8eed50c29536fe4217b89340103f07f_s390x as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-cli-tkn-rhel8@sha256:ec8e4322d9d75fbaf2bbdf87d80f890af7e59b111a03138e2ea9e8e21a9841fc_arm64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-console-plugin-rhel8@sha256:458ff95d3645b3904d6ff93b5a2da1759a27e9d0d775c8adf598ab6886eba175_s390x as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-console-plugin-rhel8@sha256:5cc1a8b7a7d6af4681e93dbcf378bc0b1cac853aa37172dd2e64950e33b0d390_arm64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-console-plugin-rhel8@sha256:6730b6c5d63b9fbd7e10150fcc5e62c0145320a949f0dda56ae0864561651729_amd64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-console-plugin-rhel8@sha256:ed1ecc41d06d040907ac59e0c39ddd6429770cba6628fb532228f3b1b4b1233d_ppc64le as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-controller-rhel8@sha256:5da6397f22e3ebd8a8d363f39d8cba2fdf15b13a2f8955488ac2b047a2ee3b90_s390x as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-controller-rhel8@sha256:93e0a7bcbef2432c645a0f7295035776950ff2018452b6a63bdd3af9312746c3_arm64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-controller-rhel8@sha256:a0c347a5c888baedebaa32eecf9cf6f625fcf37ade2f42702ff6bbfb306e68f8_ppc64le as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-controller-rhel8@sha256:a1e781866d3c356f38e89a3937d6b96a3c15b7b880f1a5c35fe7e106f81213fe_amd64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-entrypoint-rhel8@sha256:43dc6d413eab18ba5fa27c8acbbc437dbb21294b47be41cb4e77bfa49ee6776e_ppc64le as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-entrypoint-rhel8@sha256:60c70453cdda43c61fe75aac3e95ffde9b1c8cc06dae9749017020586dc334ef_amd64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-entrypoint-rhel8@sha256:72c17887a35bc880045ea9ef7d2fcdf5fda106f563853102582661698d71af74_arm64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-entrypoint-rhel8@sha256:c77bfce0abaac800970937b5348cf16b631a101f6e96c743d5782f6b420d191a_s390x as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-events-rhel8@sha256:3dd3c388b1acf33c0d651b32bc0510395926e5e5444f6c3fd2e72c4ac00cb64d_s390x as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-events-rhel8@sha256:72d9112a32a3e0598883a679cd2937fee73dffd502ddb2e44350e7e6625175e7_ppc64le as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-events-rhel8@sha256:81994abd500fe05fa9ebc1bb6ccfde573ca1e2acafa3a943f31dc2a5dc5599fd_amd64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-events-rhel8@sha256:acc4cacbb79098e2430a51abec6667bcd401591b9d8c250978328360e947caec_arm64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-git-init-rhel8@sha256:4f8fe30627b138387849db8b9e027c6600b4d8e8a9fb60898dd087ac04a3fd10_s390x as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-git-init-rhel8@sha256:5fc0894cf8677cf0b4540dd45001085a1c6283666757196191311276ff1f52f7_ppc64le as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-git-init-rhel8@sha256:bc596235b5108185241212de4315eb2fd1d520586041704fe6ea0f0556682f9c_arm64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-git-init-rhel8@sha256:d1ef4d43c288a2e2be270932d8bee2ebabe08d1c05eaedf408e8d3f08bc37d3d_amd64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • openshift-pipelines/pipelines-hub-api-rhel8@sha256:38df2ee7b5531f7d2539a9b43cb4dee79c9afc3c47a9acd7a53352381bc77e0c_amd64 as a component of OpenShift Pipelines version 1.16 for RHEL 8
  • +83 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (4)