RHSA-2024:10852HighCVSS 9.0

Red Hat Security Advisory: RHOAI 2.16.0 - Red Hat OpenShift AI

Published
December 5, 2024
Last Modified
August 31, 2026

🔗 CVE IDs covered (4)

CVE-2024-3596 →CVE-2024-10963 →CVE-2024-24786 →CVE-2024-49767 →

📋 Description

CVE-2024-3596 — freeradius: forgery attack CVE-2024-10963 — pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-49767 — werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms

🎯 Affected products28

  • Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-codeflare-operator-rhel8@sha256:3fc2da180ef549a8041ebe6a5f5f24869a012a2416c2d3e154b2a5ba9645bf60_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-dashboard-rhel8@sha256:c2a79db6d2ba9c313640149a55f306e8aa4dc36f3cc24bf554c025503b013644_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8@sha256:0d5e5f17b2eac616c8f5701f89e7309b35000bb7771c311f8763b7b9d1f174a0_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8@sha256:c5d22d63f967e5cf4bd35488dcf64ce0765a6a2a1070a911f66d7bf6f94f1136_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel8@sha256:4f7b6a45b4db2861c7e1ea225405ffcac3cf112b8eb9cf5a1c9fa7ffb68f6820_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel8@sha256:3e670a110eb3a6e59c6051b485bc88d39cb921b31854f36073f2088d52b53ce1_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-kuberay-operator-controller-rhel8@sha256:efe0ec7e60c371b02f2d8431aab69eb1e2ff6c9c93c83d48f8b5e8a5e8d6e46f_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-kueue-controller-rhel8@sha256:1fe9fb65f747f217c0f247519b23f702d0dfdb9fb471f99382afa9c25fec3c6f_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-ml-pipelines-api-server-v2-rhel8@sha256:4bc8931d063ab56fc99a62bf5b606e9f99addb61b6c097ee0401f7e31787a123_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-ml-pipelines-driver-rhel8@sha256:348e66c3e1e3c17106c4f4957c5e7b9bcefec80deb00e4900066262c356bc308_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel8@sha256:f1861c81fbb70c28f408072b1bf1b4b79ae1a19637700c455f8133d191e78e6b_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8@sha256:ab129822211bc9af41a3a52ff10a88d7349a122d0c4e215c824f4e77437cad5e_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8@sha256:59aa33eb2adff1533465d89a6b86cb52c1823a4b724cc5fa535445277826ecf6_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel8@sha256:d0e26b14b5c09c23193fbca6409e6a7124baa97138dfc75de17b48241636a4da_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-mm-rest-proxy-rhel8@sha256:c693bd7449c90b7406ce66652524d575c2b875d5c9f14f7ced79adf9c98d5fcb_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-model-controller-rhel8@sha256:56df2f7095c98e6aa73caf59bbb088ef0824ce0db6acdd5c3a15df53bfd3dbdd_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-model-registry-operator-rhel8@sha256:1d348086632e5f94c923f91e40c823ab1c27c3b0abc008e8266abe2fd86062a5_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-model-registry-rhel8@sha256:60c9d0b547ad4d46cdabeb0dfb0c835c68c43bd34cd83b196155899b93017e38_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:6f1ad9675887881dfaa7a8dd81a36ad86c9148f4882141f74b66b28144a73f29_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-modelmesh-runtime-adapter-rhel8@sha256:5f61cf084b1d79ee1b651f2b1777ff238c3e31eb76eba71ccb33b01c46f8c1af_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-modelmesh-serving-controller-rhel8@sha256:873167913efce726fe05667f2a5d3bbdd4aeedc6db905833c9ec620f39a33bd0_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-notebook-controller-rhel8@sha256:f96f5d774a07b8f345ddab253cc2671c92a8ba85dda89bd89e5e3c4f126eca50_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-operator-bundle@sha256:3e647011ba1561919aaac2c65fe605eff4c64fff4cc229e12490f90dcebf3669_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-rhel8-operator@sha256:8eebdb1fa9004bc34fc637ac6e8f195d0f7b71356714ef495c4c1f89d783eb84_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-training-operator-rhel8@sha256:68ca253d57a89eedda4bd65486ca480a25dd15ea1f7ff0376a50c7f4a40e1395_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel8@sha256:ba0929d09d596250ce4c35fc8e8ea1a325c35e87cac2fd4106d96573a870db12_amd64 as a component of Red Hat OpenShift AI 2.16
  • registry.redhat.io/rhoai/odh-trustyai-service-rhel8@sha256:feebb0e5015cba9d86d8ebf711c993f958f4cd01a935a136232b64fdd25bec0c_amd64 as a component of Red Hat OpenShift AI 2.16

✅ Remediation

For Red Hat OpenShift AI 2.16.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Workaround: Disable the use of RADIUS/UDP and RADIUS/TCP. RADIUS/TLS or RADIUS/DTLS should be used. Workaround: To reduce the risk, administrators should ensure that no DNS hostname matches local TTY or service names used in pam_access. Additionally, implement DNSSEC to prevent spoofing of DNS responses. For stronger protection, consider reconfiguring pam_access to only accept fully qualified domain names (FQDNs) in access.conf Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: The Request.max_content_length setting and resource limits provided by deployment software and platforms are available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.

🔗 References (8)