RHSA-2024:11293MediumCVSS 7.5

Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.6.4 security enhancements and bug fixes

Published
December 17, 2024
Last Modified
August 2, 2026

🔗 CVE IDs covered (3)

CVE-2023-47108 →CVE-2024-45296 →CVE-2024-45813 →

📋 Description

CVE-2023-47108 — opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics CVE-2024-45296 — path-to-regexp: Backtracking regular expressions cause ReDoS CVE-2024-45813 — find-my-way: ReDoS vulnerability in multiparametric routes

🎯 Affected products141

  • multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster engine for Kubernetes 2.6 for RHEL 9
  • multicluster-engine/addon-manager-rhel9@sha256:23143ae93a89dcf6c8e1bf08397890613a6ede3574bc7940069cbd7d31e480f5_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 9
  • multicluster-engine/addon-manager-rhel9@sha256:36475cc5f62cf39ddc23ae8dd8f298658ad8f0a13936b924e4aa18e83b945751_arm64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 9
  • multicluster-engine/addon-manager-rhel9@sha256:e3678da21391e415fc4dd938c198a089edbb7be2cc685e15018215b6d80a26ea_s390x as a component of multicluster engine for Kubernetes 2.6 for RHEL 9
  • multicluster-engine/addon-manager-rhel9@sha256:fc653e1b94e2e36891c8ec3ec438cc13269b9d0f7543310c401434ab33589c41_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 9
  • multicluster-engine/assisted-image-service-rhel8@sha256:190d74d8d66c59ef65f3c34a922ef8da476ce9b0713799b9b8bf237867977556_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:2ee11ed4a9574fce3c9451478e27b08fadd8ce47070fc49ef9f131e1f5faa3ac_arm64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:b12de2b40253ccf4a4a09c89cc486ec21fb414ee0c4751970cc05855509388aa_s390x as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:d33a188234fc6ff2ecbebe35a334b2410aea304d9576fda3da49f759e4625907_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:00d73fa8e6ad61849c674628a0ca64cf114defb03996184f168e246bfb6e687d_s390x as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:248f72d87c45300991ddc150da021cc7fd27d05c9d51dab406c41017c7dc88d9_arm64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:bb4d78cc637108569f3a7be07dd40d94b66e96c6f13be72a975576b9fffc69e0_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:c3be60b1d314b96873e08fcee525ef243ece76f5612cc4d9d76a8282f323b2fb_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-installer-controller-rhel8@sha256:12097bef19066a7b2760d0fd98ae5a0534300fcdad0a466b054b94b5bd234ade_arm64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-installer-controller-rhel8@sha256:17f97e5d57822c6a4449f41a459d19314ad0192ab8a2e83d97052a1155aa5c19_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-installer-controller-rhel8@sha256:aa8d8af5780efc0c5748973278dc0976540586cdbac24cf634bf0f9232a7e53f_s390x as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-installer-controller-rhel8@sha256:c2b1515200945e18121898deba89b997839b38e9efc06a80c77835b8a935f10c_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:278c5da1432f652279ad5772ce44cdda1c0d6a68c0babd23b4cea637ccc84ba7_arm64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:44623ead7a8a6b3405c13e03ceac450b17fad1276a6dfd9b89809abcda83fc4a_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:7f27cf0d4e19bdcbbe454cb2960345db79487ac12fab0f5f2730398ad2162cdd_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:e8c79fe55b27a591223656b42ed3121815087ed1070b53c8595ce83fe1ca7182_s390x as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-service-8-rhel8@sha256:28952bd950d6d710f83637ee9865adbe5c9cd670518e76be40b4af7e6bee2647_s390x as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-service-8-rhel8@sha256:b70d06dae56a877eca6ea154622517b6da6c08fb991c01796909764fd827e048_arm64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-service-8-rhel8@sha256:d018e8046f460379140ad2a73b8883de6150d638b54745b1b3fc6a9e2ebe63b7_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-service-8-rhel8@sha256:f2d4b3f7d3c6434e01f2fe220d073825d5ad8fec286c9786494773d13257c427_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 8
  • multicluster-engine/assisted-service-9-rhel9@sha256:05d65257062917ed42e4ea33216b7dc5f1f826e7084067aa714ee98182abf2e9_arm64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 9
  • multicluster-engine/assisted-service-9-rhel9@sha256:4e189e743c8b9efdcf42ffcc8f5c0ca2e5cf6dd94803b9d5f4d59324b929ed43_amd64 as a component of multicluster engine for Kubernetes 2.6 for RHEL 9
  • multicluster-engine/assisted-service-9-rhel9@sha256:5e9ddf2ea27a7ba6294a0953d18d49f3e255c454a620d203ce9afd989e3d2ce1_s390x as a component of multicluster engine for Kubernetes 2.6 for RHEL 9
  • multicluster-engine/assisted-service-9-rhel9@sha256:f653138bb8abf877ae4ed0fc3117387b53a41ffd7a4b1ce8a01be84cb7634a3b_ppc64le as a component of multicluster engine for Kubernetes 2.6 for RHEL 9
  • +111 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/clusters/cluster_mce_overview#mce-install-intro Workaround: As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (5)