RHSA-2024:4028MediumCVSS 7.0

Red Hat Security Advisory: Release of OpenShift Serverless 1.33.0 security update & enhancements

Published
June 20, 2024
Last Modified
August 25, 2026

🔗 CVE IDs covered (8)

CVE-2023-45289 →CVE-2024-2700 →CVE-2024-24783 →CVE-2024-24784 →CVE-2024-24785 →CVE-2024-24786 →CVE-2024-28180 →CVE-2024-29025 →

📋 Description

CVE-2023-45289 — golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect CVE-2024-2700 — quarkus-core: Leak of local configuration properties into Quarkus applications CVE-2024-24783 — golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm CVE-2024-24784 — golang: net/mail: comments in display names are incorrectly handled CVE-2024-24785 — golang: html/template: errors returned from MarshalJSON methods may break template escaping CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-28180 — jose-go: improper handling of highly compressed data CVE-2024-29025 — netty-codec-http: Allocation of Resources Without Limits or Throttling

🎯 Affected products142

  • Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8@sha256:11c6882cc0742c3c53d3bcd0a6d71b12ccab2c5328fec32653e350d00080ee07_s390x as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8@sha256:6066803415b4d7e3fc4571f12b6dabf4922359bdb8fa3dd8c721a4ae0de925b3_ppc64le as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8@sha256:956655c20c6fa30304a8c459b99c263649fd145edaeb7c70f29fad1b0a093882_amd64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8@sha256:db18592c68475a5101a18cd71f23b9e04f3e98d404241007717c5208cd82ff3f_arm64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8@sha256:26bd5ba0245ff41b8be8755c75a052e81e85a132fa7c66251c7863eb47f80591_s390x as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8@sha256:4c8825fbd0600ca85b933a941bf073bc2ff9bbf3163b9de8b9795dcb8eef2cdc_amd64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8@sha256:62d5fd58a6c03a51c26bf894255c42e6890828ba1b056e61fa037dbea4726c26_ppc64le as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8@sha256:90cefa9c45ef022442f0f528b290cce1df0957dae1b3feed7203d44b8b440609_arm64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/client-kn-rhel8@sha256:7c30419b83e1ffd4f1199074d7cfcdac12c07b124d25ee176fd835707e3dacec_amd64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/client-kn-rhel8@sha256:874144b4d0f4be24e3391a608f650af4eff965023ba8d59a7cf32c5ca88b3df5_arm64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/client-kn-rhel8@sha256:c8383b72832594a098ad3a27f3dfc6b3aac285a46b76eab1e9658c11f1d4c358_ppc64le as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/client-kn-rhel8@sha256:f1a607794e584e68115700572e86f3af8f161eea03fc8251c9a670d5b97bf7de_s390x as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:01082c24eecbe835ac498e62ded56790e4534dea024faaead9e42874d88343ad_arm64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:7c50445c76a41f63b61aa9388ae2cbb303f3600629db83c501ab1de9bd2acd7a_s390x as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:be492cc6fb590de87ae896db89996c267cc2d89d788c64907c8142665c696020_amd64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:f486c4bfd0a6ec1173aa0d597725e9fdf7c670e27eec8593eee89eed199ff3ca_ppc64le as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-controller-rhel8@sha256:0ea71c9e6b4a8b733cf0ff9091ef1ae58d142a9dc165402d55894804d5bff732_ppc64le as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-controller-rhel8@sha256:0ee12aec286534233cc0e622165c6d3f236cb0cae3039f054ebcedbddec64214_s390x as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-controller-rhel8@sha256:125d5cc02f87a538eae11dbf4def83770258b96642afaa07d34a96825d4fea35_amd64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-controller-rhel8@sha256:a1c9fe0a49ca886eaf8092227ee80b498acc56504cd890bf1a98c2d11753b680_arm64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:359af27aae18c7839a617765a2d635828ec64e9bc710dec23fbfa3fe75a3c9e9_arm64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:54bea569827ff8e2d08bb87c6175cda2e159cb366ddd06e61693b14474f11b8b_amd64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:6c7712e760335cebea74e3174137ee5b9ed42fb9090437616d8ea52bd0847015_ppc64le as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:7e68c45a84379bb5ba8e4aa1e22c50ac6d40f7e7fb7ae58bbc72b770d1ad080f_s390x as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:54fc3ac7f7ce24b1d6b3cb8bb5c61163d69a573152c548681d23c04bf1e40299_s390x as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:9bd0160cab40028bd5ddff970ba822e03a8ee60a1171a4637806f8b81db14af9_amd64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:e6e0217a9ed70feb8b9939b1c6506a49dddd2241e3ec71089ea01edef89c19f7_ppc64le as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:f315f116df7b1e57ee456e5bcdd885f84477062d5c71fe2f82838099eb3d82d1_arm64 as a component of Red Hat OpenShift Serverless 1.33
  • openshift-serverless-1/eventing-istio-controller-rhel8@sha256:3c2d9de6e929b9356cd52b8cc1909654765af899d604c2aa946c59931d403550_arm64 as a component of Red Hat OpenShift Serverless 1.33
  • +112 more not shown

✅ Remediation

See the Red Hat OpenShift serverless 1.33 documentation at: https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1.33 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Currently, no mitigation is available for this vulnerability. Please update as the patches become available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (14)