RHSA-2024:10857MediumCVSS 7.5

Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.7.2 security updates and bug fixes

Published
December 5, 2024
Last Modified
August 24, 2026

🔗 CVE IDs covered (3)

CVE-2024-45813 →CVE-2023-47108 →CVE-2024-45296 →

📋 Description

CVE-2023-47108 — opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics CVE-2024-45296 — path-to-regexp: Backtracking regular expressions cause ReDoS CVE-2024-45813 — find-my-way: ReDoS vulnerability in multiparametric routes

🎯 Affected products141

  • multicluster engine for Kubernetes 2.7 for RHEL 8
  • multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/addon-manager-rhel9@sha256:2780bdb2895e5fd8e7d5f6d371fe7b25ba38644e069fda48866f8bf010cea6be_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/addon-manager-rhel9@sha256:33599e704c834328838f6cbd0a098de2a7e29c09ba23e86c0a3d9256d159c44c_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/addon-manager-rhel9@sha256:866c9c236bfb0ecebbd67db6a50a1f97dd9679891c64a883a2448dbafec90ff6_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/addon-manager-rhel9@sha256:e9d0f46ed5ca82dc35d599c356f58c9ad3a5e8f1e3b7f0da388ac22a2684941f_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-image-service-rhel9@sha256:2764ed3c7fe82e3d8dc704008993a6b3c7bfafce5901fd24b48f1ca8ef3a6567_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-image-service-rhel9@sha256:903d186f89d560c7f8d2dc4720f8e28b63fe7289093e47c04406513ee7eabfb4_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-image-service-rhel9@sha256:9a3ccfb4c070d77aca31c3e539af77cb2730d360c5e7fd06eef3c74d94a5ae43_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-image-service-rhel9@sha256:efd08d01f8c84b9f7deff92171e50a381312959706c320619e42f48c5a200bf6_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-installer-agent-rhel9@sha256:10d73be29134a35bedb64c4eb6f07a42ef83e6a9170e830d91e01cd5fffbf3f9_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-installer-agent-rhel9@sha256:2234f67093d9932de84795286da6b8be4bc2a20eb2071b33dac696dc87e12e34_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-installer-agent-rhel9@sha256:a104da0c24bd1c5ba6dbcd675e6f7997a7863d310f0d614c236c60106f793da2_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-installer-agent-rhel9@sha256:b02de592c02d74df748809a6b6020bedbb08c058b040478128cb6c1890c4a8bd_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-installer-controller-rhel9@sha256:15d06ef938b1127e3c5f66cb85226b084fc6cb3a8831df7360c8f042d981032a_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-installer-controller-rhel9@sha256:3b1591a90c11ba9c700b81f418d13f247fa6b391556ef1a84af6e50943bd197e_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-installer-controller-rhel9@sha256:6032d309dbeb45ab97981602157333bdf13dc9371ca7e508cb24b81893027c50_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-installer-controller-rhel9@sha256:d532732b5c993a4bad63100ec051116f1b010cb500567fe723d1dc932a38e311_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-installer-rhel9@sha256:246d610b028972ac5b3d107e9d77faf2732dcf200e61d7b678bc536fbcc59822_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-installer-rhel9@sha256:3a60f6a24ea17ed52006b4da2b2c2ed12bda4fcee69e6467fe41dfa07459012b_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-installer-rhel9@sha256:84663267fa2cd7d8e74a489c356e487182639f7a6bf5e81d6ea9f3126cbb7259_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-installer-rhel9@sha256:8507fc198d95c582452a27c182e7d247c033a21c3c428974faafaf15ed7a1275_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-service-8-rhel8@sha256:0fe407972a242f0f46caabc9c8a19dab42218d7c6cddb64e03eefbd6fa99c1b9_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 8
  • multicluster-engine/assisted-service-8-rhel8@sha256:42d062a5af660a38f4d6a85aa4a405f6ad31bad2f4b52a62b1ccb807ef6f957a_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 8
  • multicluster-engine/assisted-service-8-rhel8@sha256:471efec93c27b4b3a9e3aee09a5a302ce86f0801e4643cdef75b866803bc7eac_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 8
  • multicluster-engine/assisted-service-8-rhel8@sha256:d98156d98030e5a2c74785a3893c7ff7651e390cf39086c2ac452dca3c2ecbc7_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 8
  • multicluster-engine/assisted-service-9-rhel9@sha256:3e48e2affc12a3575d79d03e8480c16f27788cc1f78e7b4404191b8808ea9e05_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-service-9-rhel9@sha256:7f1c0f68a2d06e7cb078bb73865e12b9a6b9a06d69cb5831a0f1931575159faf_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-service-9-rhel9@sha256:e6529c02746b61eb53c8b1416ac8bb7e81efd714780b1a63c9b493a5bce0c204_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • multicluster-engine/assisted-service-9-rhel9@sha256:f9f3c1b29784995a9f7402622f3af8081e928714cf366ecdecdc0edf2553f45d_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9
  • +111 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/clusters/cluster_mce_overview#mce-install-intro Workaround: As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (6)