RHSA-2024:0298CriticalCVSS 8.1

Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.9.2 security and bug fix container updates

Published
January 18, 2024
Last Modified
August 24, 2026

🔗 CVE IDs covered (2)

CVE-2023-49568 →CVE-2023-49569 →

📋 Description

CVE-2023-49568 — go-git: Maliciously crafted Git server replies can cause DoS on go-git clients CVE-2023-49569 — go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

🎯 Affected products176

  • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-cluster-permission-rhel8@sha256:5d4ba7347d1b94e1ffadc560153c4d14a87262f07512591e6e53b01466262672_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-cluster-permission-rhel8@sha256:7baa4254add4bd88c4a34796f40279393a1a81fb2c80f66f5abad0570908450d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-cluster-permission-rhel8@sha256:a3b19da6c7202e0b30083c1c28ac092041610d5485d76af8fa995519ff4789ee_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-cluster-permission-rhel8@sha256:d1f8bba5192122ed6e042f685f53463ae1ea0e41ca6cf52332ca3ed1481e508f_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:18e4baf02655b518e6a3407e4c1194858d7fb019de1f81de0e6fd5af8c037f04_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:80ffa43c41e804e1c6496c6b1b9348d259249ecba81d5fcc98346982c304beb8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:c6ae670662d98db9260a5ca3f925a8cf3aab0c415060f2e237102a2e01390d27_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:df450b13fbb57815ed6e5334186dccd242e54d61444538c8379b2332de460f2a_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-framework-addon-rhel8@sha256:0573b8c15c3832427c55e21241c5f97bee603fbdcf988a9d1f30fe9dc14d6f7f_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-framework-addon-rhel8@sha256:6b05a494e63d95c5c5173556f9781e6ed339833c71cc1ce459afbb8e35eb4dc8_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-framework-addon-rhel8@sha256:d277e101c7750a144cd3a5a3a342731161bf31d3fdd8c5c96f492ca6526cc839_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-framework-addon-rhel8@sha256:e7922b9df50aeda25ca2a32a75bca4a912741726fdc58b3122bffebfcd060870_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:ac5701329e933ca67bb23a8f03f8f09c115cfbab79d83958073ddbc926cc67f4_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:b51df9531f80078a2ff4ef9e8eff8467e033124f7ffd4621f0ef6cec4bf28696_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:b7f3faa171b6def36db3a3abcd0a12a57d804c54890aceb78759be8cb5344199_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:dcd1f6c30cca0f4ef1880d22de972c736e7c569d51c78306a8742f4cd3e25a63_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:2a40e434a42298f400139343f2dd64b77b9ad24da5b3ee43cf58f3e9dcab1615_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:3f3dfc40470aa2d83e4c69e6e554f00ff60ed778c40673306509f4ac5b6fafdc_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:bfe3d00c2984b063d517e892094601dfdcfd7457ac05ad3085a0ee8b7a6848bd_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:e913b839a3a79f043b138904b18a8ab319f87f6d6ff6dc092b3f2a7aaaf1ec25_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:53c96e114c1b41cd77cf6849a5d48e54e4b0cdec851f1f20b877bf4dda052c4c_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:b9c5c21c8ca90e55a7b77be14c9b8b001c1ebf327b403969f295177ef7346aff_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:db899fe165fa8b73af08b1cfee758718bf40442d308f5d1363a371407ee76688_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:1d1c0a25adce3c7c432ae4cf0adbcdcdf0f6d13558d11d85924af94085204463_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:93f45b2ad808e6361a1b3092b1b9b1c46cfbb8d362b787d782b52fa9a62ed242_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:be03b49bed1d2413f63d2730e0af276541e18ac4c94f9a3fd5e4cace46a8a55f_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:d96fe844f3b017dfc923aaae05a89c5c60ab79c71673a397e5dd4b468e6a4297_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-prometheus-rhel8@sha256:5e91e42c1b572fda8ea0921fbf0708bda0dce920e1a6a05c7c9383eab2de3dc8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-prometheus-rhel8@sha256:601e96fd821de9f0e32c32f22fdaff6d0077f076f0f0e342b15ad44ee0aca9d6_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • +146 more not shown

✅ Remediation

For Red Hat Advanced Cluster Management for Kubernetes, see the following documentation, which will be updated shortly for this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html-single/install/index#installing Workaround: In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.

🔗 References (9)