RHSA-2024:3718MediumCVSS 9.9

Red Hat Security Advisory: OpenShift Container Platform 4.17.0 bug fix and security update

Published
October 1, 2024
Last Modified
August 25, 2026

🔗 CVE IDs covered (11)

CVE-2023-48795 →CVE-2024-3727 →CVE-2024-7387 →CVE-2024-24786 →CVE-2024-24789 →CVE-2024-25620 →CVE-2024-28180 →CVE-2024-45496 →CVE-2023-3775 →CVE-2023-5077 →CVE-2023-5954 →

📋 Description

CVE-2023-3775 — hashicorp/vault: vault enterprise’s sentinel RGP policies allowed for cross-namespace denial of service CVE-2023-5077 — hashicorp/vault: Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets CVE-2023-5954 — vault: inbound client requests can trigger a denial of service CVE-2023-48795 — ssh: Prefix truncation attack on Binary Packet Protocol (BPP) CVE-2024-3727 — containers/image: digest type does not guarantee valid type CVE-2024-7387 — openshift/builder: Path traversal allows command injection in privileged BuildContainer using docker build strategy CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-24789 — golang: archive/zip: Incorrect handling of certain ZIP files CVE-2024-25620 — helm: Dependency management path traversal CVE-2024-28180 — jose-go: improper handling of highly compressed data CVE-2024-45496 — openshift-controller-manager: Elevated Build Pods Can Lead to Node Compromise in OpenShift

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.17
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:696151f23b45ec18908214e931d1f2d24f6539d0f1a51f36c051e32943cfea67_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:902ef891a30409df31a88ac2f261f0a0481add719b7e30dc1e4ea94abf83ab10_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:cabc1c5ac8aa858bb277856aff522a624042fed8499f9fb803367289c70696d8_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:f8b1471a9691bc88cdb8dd4c2bdac9057d4f6ff1638e58373a6e4b25a911b7a3_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:17d2151744d630a06a2c49ef98edcc0472926d3f45f31fca42dfebfca887fe4e_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:60503ada08eaf8d08fa9ccf41b52b064e8bd62859373cff9d33a6c8d5c737b1e_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:d92e5d15a377ff25b01d5d6dfbb1bbb6bc6c1beca09c446c47e8b5993bb5db2d_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:e8585b324e53d471b682ee28d97114810f90253e9e1f79e7f8ae0f8bdca5df6f_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/cloud-network-config-controller-rhel9@sha256:6499f07eba6f42ac3de2d205255e94eda0cdcb0ec90a7d5933b73636ad5817be_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/cloud-network-config-controller-rhel9@sha256:66d2c67f9d4b84f6460c9025d46283b78208d5944fa4bb6af6417f76e5c8f3af_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/cloud-network-config-controller-rhel9@sha256:71d33d111fb24fe4a979c8956135e90b4c9adef5dc29d96f93a28ae0236a4f58_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/cloud-network-config-controller-rhel9@sha256:91437488c48e8aee8f773144bbca16ee835fe073162dd246963fa1a2ac57674f_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:471786f02ab4a23ca05918155d71073caafe76f1fe94c150661922c3fd09662d_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:6004192b636c431cff841c3ae3aa41aafbf68bed881ba3bcf52246ac6877237f_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:b029ef6c12a9b26bd8ec9746204bd545ef888dae937204c7b502708ec624e14b_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:b8b5b8e93aca3807d43c24c191f85f373e8c21359cf35abe19336bfa2f2f0ac2_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:5575ec1b76a5575ada38b2c7632959bd455af4e9d4e2787c409ffb1d37f94235_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:5ade3bb39301509ce941b053f2c943e381b8ea5f6d5337c72a58ee33ff27b391_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:7d7cb4288eae61535e8f6c538793ba2c613f8b37eeceba9726116150452eacaf_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:f2636fbdd34cba0f24af7ae0da597532604ad51d5500ce5ba383d1c1f619f5f8_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/egress-router-cni-rhel9@sha256:4367dde98d17d89bca1ce7c2ca8802300df64ef6d0d4a54b0789add7468b978c_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/egress-router-cni-rhel9@sha256:4b78293f7cf0a15740b0c82fe322f757781d55d8366fa01c1148af719a3441c9_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/egress-router-cni-rhel9@sha256:595077a734f0fbef65187a4562d51ed5f323128618316035a7ff4ac858b5e6cf_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/egress-router-cni-rhel9@sha256:5b8289670f7e049afda46ae34819ad0c02c8606be756dc9120a491584d6b5722_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:05aec47952706105e238dfccf277791691b31b82e4c4482b513f54cb13bd0d9e_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:694df1277b8038278a3b0859311bc8aac42759d797837ffd2056e95b27eb4cd4_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:6db46367a448240e95dd1fb17180538a6ea1ed73c692dc69901e1361ac5c3938_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:8e5554254861b84b42b79dfb7315a3bc528abf530878545884916ba42e7b16a1_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/kube-metrics-server-rhel9@sha256:49613547e5d9d9c88c52e62aaf5fee925d5f91d3b0b1c72f906d549c78e7eea2_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:fbad931c725b2e5b937b295b58345334322bdabb0b67da1c800a53686d7397da (For s390x architecture) The image digest is sha256:9054f1987c9a0128374f2e7fa91a0b9d074d9665ef48758e6f29a89c14edd8f6 (For ppc64le architecture) The image digest is sha256:8a457e302eb66d06d17cb5cba491077b92a623217e05d486740969974b2aaef8 (For aarch64 architecture) The image digest is sha256:c9c31f9120f1049b88b282be4589d1da504ee436dfa51487349d08fecd29dd1e All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Update to the last version and check that client and server provide kex pseudo-algorithms indicating usage of the updated version of the protocol which is protected from the attack. If "[email protected]" is provided by clients and "[email protected]" is in the server's reply, no other steps are necessary. Disabling ciphers if necessary: If "[email protected]" is not provided by clients or "[email protected]" is absent in the server's reply, you can disable the following ciphers and HMACs as a workaround on RHEL-8 and RHEL-9: 1. [email protected] 2. [email protected] 3. [email protected] 4. [email protected] 5. [email protected] To do that through crypto-policies, one can apply a subpolicy with the following content: ``` cipher@SSH = -CHACHA20-POLY1305 ssh_etm = 0 ``` e.g., by putting these lines into `/etc/crypto-policies/policies/modules/CVE-2023-48795.pmod`, applying the resulting subpolicy with `update-crypto-policies --set $(update-crypto-policies --show):CVE-2023-48795` and restarting openssh server. One can verify that the changes are in effect by ensuring the ciphers listed above are missing from both `/etc/crypto-policies/back-ends/openssh.config` and `/etc/crypto-policies/back-ends/opensshserver.config`. For more details on using crypto-policies, please refer to https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening Note that this procedure does limit the interoperability of the host and is only suggested as a temporary mitigation until the issue is fully resolved with an update. For RHEL-7: We can recommend to use strict MACs and Ciphers on RHEL7 in both files /etc/ssh/ssh_config and /etc/ssh/sshd_config. Below strict set of Ciphers and MACs can be used as mitigation for RHEL 7. ``` Ciphers aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] MACs [email protected],[email protected],hmac-sha2-256,hmac-sha2-512 ``` - For Openshift Container Platform 4: Please refer the KCS[1] document for verifying the fix in RHCOS. [1] https://access.redhat.com/solutions/7071748 Workaround: Cluster admins can follow the instructions in "Securing Builds by Strategy" to block use of the "Docker" build strategy on a cluster, or restrict the use to a set of highly trusted users, until the cluster is able to be upgraded. https://docs.openshift.com/container-platform/4.16/cicd/builds/securing-builds-by-strategy.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Cluster admins can follow the instructions in "Securing Builds by Strategy" to block use of the "Docker" and “Source” build strategies on a cluster, or restrict the use to a set of highly trusted users, until the cluster is able to be upgraded. https://docs.openshift.com/container-platform/4.16/cicd/builds/securing-builds-by-strategy.html

🔗 References (846)