RHSA-2024:1887HighCVSS 7.7

Red Hat Security Advisory: OpenShift Container Platform 4.15.10 bug fix and security update

Published
April 25, 2024
Last Modified
August 6, 2026

🔗 CVE IDs covered (3)

CVE-2023-47108 →CVE-2023-49568 →CVE-2024-1139 →

📋 Description

CVE-2023-47108 — opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics CVE-2023-49568 — go-git: Maliciously crafted Git server replies can cause DoS on go-git clients CVE-2024-1139 — cluster-monitoring-operator: credentials leak

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:0f3ba8ee8a4129967bf99ceab42fd978bd74fc3b68eeab02183db1d31f7d15ed_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:2b7a05a4b1539e891749c231692ead54491a36026fae2cac1049b4490d6409b9_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:75ea15711771419caa86fafcffadb983baf134e9cc8a835b44e5659df87685f9_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:d6087c7ad2318caef06d61b446dae4806f59599e1e9a5360939d88e07504fa1e_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:49002314947433c72ed2945dfb174326fbb4d4122082978c11cdb395cef1863f_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:be818782c507d76b48f9f37bcf85e5d5311514ff9e6108b047f80bf6331e63f5_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:d929e326416e29a4bbcda901c3499d297dfd90ee9ffe88cf12839a68c7ddbe3a_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:e09cbfdb289f5dd643bc157ec83f5b2bd9c1a727133d5240aabbc34ca6698bab_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:360fde89424d264932454c8bf6940d48ba6765879a010f3883f8bf20d71370f8_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:6140f45956e957f71a2aab4e13d54b6aa9745ab8245e35ba1c2f3ad7ecbc23fd_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:88b080f54f4edda4c6a3aafb22d807adc06dce3afb1989007f8f70962c6a3430_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:e42f69b3f38724da3d42cae1664ff4805583b7a265f2321e936917b3eef2f84a_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:5290ec30ce8438b60a5f9b604e5c9d36cb02b1e5d4dd7880587cbe8e10c17909_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:6cc77a52beecdebea167f4f4792225f5e5db2865231af3fb92af247074eeba5f_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:f040f7cf7c3cda94967c4c6d90887ecbfc8c244c8d12d24ad124689da2d94c31_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:f4a2234da605920f41641b6e2de7ac54853c347fef9b53324049c7f33c90ecc7_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:522a89aa30a0e5937d2d94cc966ec6a7eef55bdf9a1aa4e1af8ac72061630578_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:664db89b59ec8e63ce1d44ddf90f5dc21e538dd1ae8d1e448f0750c8b4b054f1_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:9574755a1963f0a514b498fb290272743c9adb61c37c51e7dcb5562e7ae09033_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:abb9507c65d4e2fa45d11a3f95ea2920889d23c7fbfe2adadb6287db69c38b83_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:60fef42cb859dc2da829754fbdebd451568bd2fa485401834795e3945eeb6b90_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:6f16263f947b52e1760688984abf3261734af9843764abbc1ac09a4bf32ebf48_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:ef0dad14664a50d2c5239a4b643d69d0e7b81932dfa03fc5396484c25450682f_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:f1faa15f614190d05cb546516db231fd0139f548969deb8cf754709902009d03_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:1da01cbb47638d768f46352ddf74be10652b5f73ebf989dcc7c94ce4526c1b80_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:64c7b677692811368cf3554211c805a779f90007d755e6f0c2a17cf40c94342a_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:6fa8352baa1c391ba922854330082423361e5a2978f7ca63d12811d4c6746ab7_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:bcf73869133d1ed85ebb47bc5a3d5da2d099bebf57a24e393ac45126800ca21a_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/openshift-route-controller-manager-rhel8@sha256:3d29affb1ab91a70dccc4173c0ec00d20781c98c69e49f631c4a467fc210e715_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:7111fb4cec202cb758f58d9bed95a67e7fdc417353ef15be56d7bf96356909d4 (For s390x architecture) The image digest is sha256:3dd4771c36e66984070fce29d4498d4047f4d54aaf2763758f5fb077c7e1348c (For ppc64le architecture) The image digest is sha256:87856c84d81c70fb57151720cff19f90ef7c44c9c36005c8c7e8739f772dc4be (For aarch64 architecture) The image digest is sha256:ef5e1f9b9cbe3ac42323a6aab66ee436fe12adf1c0623d17213d0fbfe45c2ba8 All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html Workaround: As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider. Workaround: In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.

🔗 References (29)