RHSA-2024:2816HighCVSS 7.4

Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.12.2 security update

Published
May 10, 2024
Last Modified
August 15, 2026

🔗 CVE IDs covered (2)

CVE-2024-29180 →CVE-2024-31990 →

📋 Description

CVE-2024-29180 — webpack-dev-middleware: lack of URL validation may lead to file leak CVE-2024-31990 — argo-cd: API server does not enforce project sourceNamespaces

🎯 Affected products34

  • Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/argo-rollouts-rhel8@sha256:23399344b865d1db11bcf2b74d021dbfac707ccf2722e5fc0da3511eaa48130d_s390x as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/argo-rollouts-rhel8@sha256:251d05db9b6a9a626d0086dcf85e3bb8225e64a1cb0148c978b1ee3527d12375_ppc64le as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/argo-rollouts-rhel8@sha256:33f1f01b97f90da1fb3138b3b1db86dc05126d735680767f84059507fac2096c_amd64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/argo-rollouts-rhel8@sha256:8c2c40cd200cce09738a49ff145832e690e7554ca45654f35f60f495142cca34_arm64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/argocd-rhel8@sha256:3d5674747ac23b12acf91e27840fd12b17238496ae35e6da1d542384a0ea36cf_amd64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/argocd-rhel8@sha256:8dbd73933f9cced7e580927d02e4e6e33216a8c1d667bd782ebf615fca0d97f6_ppc64le as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/argocd-rhel8@sha256:a9d112fe811e101f4fce4a813690aa11198fcef50494bb89f44b61b828e0e0ec_s390x as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/argocd-rhel8@sha256:f8243ed3de6cfb18c3ef0c8fdee38e0299555aa1a7281d1819cf0170798df68f_arm64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/console-plugin-rhel8@sha256:430fb91e9a2cd14b137906055e9e8ecc01565d6f8ee8ed92674df8b5333701fd_s390x as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/console-plugin-rhel8@sha256:5698dd6e2c6c5ac2b49ac57892a19e3824896400590aa83b9431f22564b79210_ppc64le as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/console-plugin-rhel8@sha256:b864774b472a9d3bfa3dd89ad2adea8e63b1732ae6f2e14a5436e06e5aaf56eb_amd64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/console-plugin-rhel8@sha256:dd392ae925a7d653c8d094e533f73c56193458dc017eacd60f6225638ca5dcb2_arm64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/dex-rhel8@sha256:322b5eac54a36a69c0d1749f9c6a0d03cf3faee1a2b1a09cba8c574d65f77195_amd64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/dex-rhel8@sha256:5350ce75a769f8c4918a5e218f93e62402ac4d879e3e4a1c4324f3cd7029ea5d_ppc64le as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/dex-rhel8@sha256:539128ab62b677a27fae6c0b6bb47bac971bbb8b7c04160611a48dbfbc29b323_s390x as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/dex-rhel8@sha256:825605739b945e56322e9d74dcb130a6615a55d43eaa4c88ad6241e4e24d3f4c_arm64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/gitops-operator-bundle@sha256:979af763119468cc4a8923b7c990273dbff274f53f64ff3d27b1505326442425_amd64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/gitops-rhel8-operator@sha256:0167f73c8281d35a4802d83a3b91ffb6f15de0996a2a1964adc9d830a7b53360_arm64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/gitops-rhel8-operator@sha256:4d8b5466648852aa7a5644186b7881ce6c22ca71592a34f1cdc6d29a5b5d0f5d_s390x as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/gitops-rhel8-operator@sha256:713dd3b04041f3d48e9d5826c665f421bd650fb828aa65efff31e01bcdd30f5e_ppc64le as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/gitops-rhel8-operator@sha256:c6db9a93c024b68604bb2fdab055b9f9544302e7660cd4ea71a31c12d678d25d_amd64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/gitops-rhel8@sha256:447160e9a36521f977e9ef519aed5bb410ee7f1dc17f35243e8c319480d882d6_arm64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/gitops-rhel8@sha256:75d1db21f1281631e932c06ca99c026d271cf2fe6bee00313fdc3c2196fa5485_ppc64le as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/gitops-rhel8@sha256:8ac7b3fd6edc96e2c6fe6f6c232102d433afe691b1afb3ea5e682f4a8bcb7c62_s390x as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/gitops-rhel8@sha256:f33ff06f272f8a55f39d60aef698eb4dc75512f319a70a73eccfc8f905da64e2_amd64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/kam-delivery-rhel8@sha256:03ef00d6c7b2e4f20ccdbb0ace77c48c6dc94eb3c9334958e950a70d17435654_amd64 as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/kam-delivery-rhel8@sha256:38c90f88f4d6e4e4bd7325687e04a98e47d75db2164e0adfb77cd7947bb706aa_ppc64le as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/kam-delivery-rhel8@sha256:5f0bd1f47bb37e6911d72b1a2fa10fcbae7d07caecc6546def8e754ea04c729f_s390x as a component of Red Hat OpenShift GitOps 1.12
  • openshift-gitops-1/kam-delivery-rhel8@sha256:e0a81b48335d4f6f9ced10ae2d7b9d054ca6b8ea9854b9965789ac731ebd8eb2_arm64 as a component of Red Hat OpenShift GitOps 1.12
  • +4 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (16)