RHSA-2024:1859MediumCVSS 7.5

Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.3.1 security and bug fix update

Published
April 16, 2024
Last Modified
September 23, 2026

🔗 CVE IDs covered (6)

CVE-2023-39326 →CVE-2023-45142 →CVE-2023-45287 →CVE-2023-48795 →CVE-2024-24786 →CVE-2024-28180 →

📋 Description

CVE-2023-39326 — golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests CVE-2023-45142 — opentelemetry: DoS vulnerability in otelhttp CVE-2023-45287 — golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. CVE-2023-48795 — ssh: Prefix truncation attack on Binary Packet Protocol (BPP) CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-28180 — jose-go: improper handling of highly compressed data

🎯 Affected products45

  • 9Base-OADP-1.3
  • oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:42dc13f4c214cf2785207914495887794a948f968ebe72495346ddff7ba94e52_ppc64le as a component of 9Base-OADP-1.3
  • oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4ec3d45a232dc0478ea0194e8d044284633bfe59e37e8e754e01570bfa633528_s390x as a component of 9Base-OADP-1.3
  • oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:52197469936ad5b710057f3ae17f58de1432af83923ccded9bdc291bff3a2d9a_arm64 as a component of 9Base-OADP-1.3
  • oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:9a2144f707c9cf35e35145e3f49898c32bc5c390af180808464fe8614a93c1b6_amd64 as a component of 9Base-OADP-1.3
  • oadp/oadp-mustgather-rhel9@sha256:2b5e5dd83ba18ab639c1307c35cc34fbad7c59648315df3341449daac9f7588c_amd64 as a component of 9Base-OADP-1.3
  • oadp/oadp-mustgather-rhel9@sha256:388055859d06499407148e9aaa52d15da3118b123a2c89ca9220e9466518ef07_arm64 as a component of 9Base-OADP-1.3
  • oadp/oadp-mustgather-rhel9@sha256:61f624d5b4a78decaed3d74edf56217ad50e8967a8e4637a2ee08f424b74f12c_ppc64le as a component of 9Base-OADP-1.3
  • oadp/oadp-mustgather-rhel9@sha256:a9c5c60ddbaee035f2b535787d3bf469b4131b4439a023dd41339db86d546dfc_s390x as a component of 9Base-OADP-1.3
  • oadp/oadp-operator-bundle@sha256:3c63b4bbf5c70b63694784857d7e4d962a5a6caddd8f62ecfb9153b861c48e55_arm64 as a component of 9Base-OADP-1.3
  • oadp/oadp-operator-bundle@sha256:82613d64c36cc435063ec02f0e3dd2edabbeb7a85763151011b6e4e617fe4b8f_ppc64le as a component of 9Base-OADP-1.3
  • oadp/oadp-operator-bundle@sha256:d1fb5950f18428d88df190793f33c68f27772fd8d867582e7ed265d631ac20d9_s390x as a component of 9Base-OADP-1.3
  • oadp/oadp-operator-bundle@sha256:d3f0997772e9e28eba7d1424bf1ea2a5790ccdc43e0823d95866941797fd064b_amd64 as a component of 9Base-OADP-1.3
  • oadp/oadp-rhel9-operator@sha256:0b824b48cc2078d31f6ac1db1b78045e08064850d95e7363f6c9e2b33c9436ee_amd64 as a component of 9Base-OADP-1.3
  • oadp/oadp-rhel9-operator@sha256:52de391f9eec3f6746e1d3f3cbbfa004a552a5c27a2983d303d18208a39cc697_ppc64le as a component of 9Base-OADP-1.3
  • oadp/oadp-rhel9-operator@sha256:699a655022299b71e8ea2d67d84cd026228127d3e7f4e00f74caf713cf28f867_s390x as a component of 9Base-OADP-1.3
  • oadp/oadp-rhel9-operator@sha256:7384faa57528c04e270f4a0599c99478d96de6c77a6759188e370e480261ac7b_arm64 as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-aws-rhel9@sha256:0974f65696e98c806c14e6812cf3292ab03a0b621714e7f091d7e326a7ebb77b_s390x as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2c176efaabf984947fb66bb33d14a637f66f06f9e7f3f7423b7fccec045a7a52_arm64 as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-aws-rhel9@sha256:716cec49a663d87eff7eaf9ddc948d2861645d601a2e15605cb660c9f98ab489_amd64 as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-aws-rhel9@sha256:c1758a4e31ed5d623b1fd9ab8deb99a15da0584a178ef120e64ad15b9fb6a931_ppc64le as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-csi-rhel9@sha256:436b76db12ba27ccafcddc38469cc2adff20d0c72e334240af84d4e8a3011c25_s390x as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9833ca3b1b53eccc9de4e117bef53bb94d5be02d89bed222ef80dcd221bc1b18_amd64 as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-csi-rhel9@sha256:b4c014e340a80ad67b422eb1d72adce21b6a01104ef6eb9225531e50c8cddb62_arm64 as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-csi-rhel9@sha256:bcd29d854e51b5a154d77134b78c6338cdb638c58cd1548704f02dddec00c6e6_ppc64le as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:1e1f9e277ceeed8be865abd424747a2a777806cde2195599e4ea9f0e787ad359_arm64 as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:4a4aeb844a7f119253763012771abce649f8b7bbdcb326f4714e72d1e318b33a_s390x as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b80b98a43c128ff17e8ba9eb80622d01c280d5ddba66e67de85cb73e415a5a8d_ppc64le as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd56ce05bbd9c6786923df9ee34efe4f6b7d1bde979705cfcd7b4d30bbc1dca1_amd64 as a component of 9Base-OADP-1.3
  • oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:24f6efdc0e3964ab1efee6e053551614de282e6bed90e9d14273cf284b20c307_amd64 as a component of 9Base-OADP-1.3
  • +15 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is available for this flaw. Workaround: As a workaround to stop being affected otelhttp.WithFilter() can be used. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it. The other possibility is to disable HTTP metrics instrumentation by passing otelhttp.WithMeterProvider option with noop.NewMeterProvider. Workaround: No current mitigation is available for this vulnerability. Workaround: Update to the last version and check that client and server provide kex pseudo-algorithms indicating usage of the updated version of the protocol which is protected from the attack. If "[email protected]" is provided by clients and "[email protected]" is in the server's reply, no other steps are necessary. Disabling ciphers if necessary: If "[email protected]" is not provided by clients or "[email protected]" is absent in the server's reply, you can disable the following ciphers and HMACs as a workaround on RHEL-8 and RHEL-9: 1. [email protected] 2. [email protected] 3. [email protected] 4. [email protected] 5. [email protected] To do that through crypto-policies, one can apply a subpolicy with the following content: ``` cipher@SSH = -CHACHA20-POLY1305 ssh_etm = 0 ``` e.g., by putting these lines into `/etc/crypto-policies/policies/modules/CVE-2023-48795.pmod`, applying the resulting subpolicy with `update-crypto-policies --set $(update-crypto-policies --show):CVE-2023-48795` and restarting openssh server. One can verify that the changes are in effect by ensuring the ciphers listed above are missing from both `/etc/crypto-policies/back-ends/openssh.config` and `/etc/crypto-policies/back-ends/opensshserver.config`. For more details on using crypto-policies, please refer to https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening Note that this procedure does limit the interoperability of the host and is only suggested as a temporary mitigation until the issue is fully resolved with an update. For RHEL-7: We can recommend to use strict MACs and Ciphers on RHEL7 in both files /etc/ssh/ssh_config and /etc/ssh/sshd_config. Below strict set of Ciphers and MACs can be used as mitigation for RHEL 7. ``` Ciphers aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] MACs [email protected],[email protected],hmac-sha2-256,hmac-sha2-512 ``` - For Openshift Container Platform 4: Please refer the KCS[1] document for verifying the fix in RHCOS. [1] https://access.redhat.com/solutions/7071748 ~~~ NOTE: The crypto-policies workaround requires RHEL 8.5 or newer. Customers (for older RHEL 8 releases) who cannot immediately update crypto-policies packages may manually configuring Ciphers and MACs directly in /etc/ssh/sshd_config and ssh_config (as used for "RHEL-7") method documented https://access.redhat.com/solutions/7066001 ~~~~ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (27)