RHSA-2024:2088HighCVSS 7.5

Red Hat Security Advisory: Red Hat build of Cryostat security update

Published
April 29, 2024
Last Modified
August 18, 2026

🔗 CVE IDs covered (6)

CVE-2024-29025 →CVE-2023-45288 →CVE-2023-45290 →CVE-2024-1023 →CVE-2024-1300 →CVE-2024-24783 →

📋 Description

CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45290 — golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm CVE-2024-1023 — io.vertx/vertx-core: memory leak due to the use of Netty FastThreadLocal data structures in Vertx CVE-2024-1300 — io.vertx:vertx-core: memory leak when a TCP server is configured with TLS and SNI support CVE-2024-24783 — golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm CVE-2024-29025 — netty-codec-http: Allocation of Resources Without Limits or Throttling

🎯 Affected products13

  • Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:c6f6accf2843a8d682184c4856ed4a33718598ac93f408a6ae176499afebb98c_arm64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:ce37e72beb00a9eb2653cf6c248abf4d569cf3a708f83a67a0d4639f4893b31e_amd64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-operator-bundle@sha256:818f32bf078b473ea3d3e414134d55b196333b179db54371c7a283e20ae720be_amd64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-operator-bundle@sha256:a737d333ff2270d1c4c5cdee31395840118f8845f1721215a0ed3339d6c0bfc7_arm64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-reports-rhel8@sha256:007cd4be45dbe9627b80ae749b78b751fe9846da0659f2a4f73e801a7207c663_amd64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-reports-rhel8@sha256:59d2392e2a211b2abfe7d7f077037a3b7d6a5a6300c993d8dd11ab6a833cdaed_arm64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-rhel8-operator@sha256:734054cf4f9b68b186ae2024caf7401321c14c63a70188f771617cc3ae83dc64_amd64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-rhel8-operator@sha256:ecbc8c12eb93ba51d9f20bc53f6d83b730e0fd3a48facc3331daa34bd38fefdf_arm64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-rhel8@sha256:99dab409d9e80a951f39c80f3429fa34ab1ed99f68d41f15fedf63cb33eb5c29_amd64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-rhel8@sha256:d8b2fe76c91ac7bfc781cb4b73289dfe88f3add9a9e3d2f452c9e1034d83a2c8_arm64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/jfr-datasource-rhel8@sha256:9b0de728776daa581545cce4c7ffac8ee35374b65968125dea89f5e896a958a7_arm64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/jfr-datasource-rhel8@sha256:f28d25a215222f8d1e19b59ea479dc22b71380cd8c3ffa99ae562727fbb1b487_amd64 as a component of Cryostat 2 on RHEL 8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (9)