RHSA-2024:1328MediumCVSS 7.5

Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.9.3 security and bug fix container updates

Published
March 14, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (4)

CVE-2024-26147 →CVE-2023-45142 →CVE-2023-47108 →CVE-2024-25620 →

📋 Description

CVE-2023-45142 — opentelemetry: DoS vulnerability in otelhttp CVE-2023-47108 — opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics CVE-2024-25620 — helm: Dependency management path traversal CVE-2024-26147 — helm: Missing YAML Content Leads To Panic

🎯 Affected products176

  • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-cluster-permission-rhel8@sha256:44c57646aa1bfcacd4612895247ba9e9eadf911867ca39185db54c026ab4bfc2_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-cluster-permission-rhel8@sha256:75955b8b48ccd8c41e9d29999d3c06925878d6b24dabeda680503757bdc106c3_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-cluster-permission-rhel8@sha256:86e046297a3aa82951eb12eee29e0bb568f2ce8595b920b7bf10d68037029b7b_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-cluster-permission-rhel8@sha256:fdd3481b50a36ac07314e50f9b3397394172f120a333530a725b9cc87f322c5a_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:112a162f9ae599f3c3cc111fb908bfaf5110a77facbfdaf68b7dbb73f1a91324_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:14d1ceb1f09565f9ed8bf77b13918e2dee0c26c792bf317754cded574627eddb_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:478c16b6c03763d4998525097cfe7a7bd98ba8cdce63cd6e478469657b421d49_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:9099824474c06c8af93437202a452fc32855392f47aced3d865440e8678fa518_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-framework-addon-rhel8@sha256:38b21007f32ac6c0c800a9165d2dda25f98403a44e8ab56ebcc84f44c69d49d7_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-framework-addon-rhel8@sha256:7da44a5417c3560fbff68b63b85d88528d937a01416ab73abb92f3c241a61941_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-framework-addon-rhel8@sha256:8d679351f8896003513cd528827f94446be2e29022d7b0ab77023d2609739c80_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-governance-policy-framework-addon-rhel8@sha256:a9786562095ca250c0bdbb2e517188e4205f98dd0ea3fa2a9e008c2977630c49_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:268decf95c62a8d9cd7f25bf840c1c5f139fc608665f1fbc522ea23db723ea1e_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:863971621e9c100711057dca557afd03389ee3477ccfb725d38dec419183a56d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:fb1474e864350415f55a05ea7678b6a52376fb97ff7a8d196b715a79393f3a42_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:ff4e33d6e8ab098b7eb9ff0d8719bea67c855f06c1fdb7f3250e0450bb976e25_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:88aa4412c199e59f751397961dad8fbf8c2033ac9d87bce091a8c36d3c88b76a_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:9fd32164ff1205cff0904e7fe3338da6b70c9444557af9efed6bc5b51fac6574_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:d5859690b70924b19b360d31b716d389f7fc5e97447d5fe1026cb1f6c61c37e8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:eaefc641f3432523df715c3490d3a106614746755b8a454dcd7293d86892b2bc_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:4a6ffd660bd594f327b9f3b2fe1105419655052ebb5eb591cf990280a4e5e90e_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:af41bc5fe38da9a71a9ebb0ad00bef2c48f447fb4a6d0996599f30253be5d840_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:e17a7512820df73b38b5d61c72dfc9478280d18214cf320900f93591b2c25097_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:38a2d2f1e6873292603c1d1a33cdd720a3c55a5e6a86f3f6e633299ce7ecfe12_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:6f1a06dddd9ca2ac8be3a93d73c30306fa79efaebceca9cc5118e4a022fd182f_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:87c71e50c7ec95b1ecbc5f874cfc43f91b4009d87e7c8728e79c774f37ac1d62_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:dc6993537a1eba2e4aec3e435b2e637ff53657863a0e4788f27229a563475c2b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-prometheus-rhel8@sha256:2aeacabd863dcae4a30f7f74a275a6ec04090031b64fe720854cb7adc10bca3e_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • rhacm2/acm-prometheus-rhel8@sha256:3da128967272aac6caff21263f390e9fedf98c9fb08838334639ca5a424483f3_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • +146 more not shown

✅ Remediation

For Red Hat Advanced Cluster Management for Kubernetes, see the following documentation, which will be updated shortly for this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html-single/install/index#installing Workaround: As a workaround to stop being affected otelhttp.WithFilter() can be used. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it. The other possibility is to disable HTTP metrics instrumentation by passing otelhttp.WithMeterProvider option with noop.NewMeterProvider. Workaround: As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider. Workaround: If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

🔗 References (20)