RHSA-2024:4591HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.0 security, enhancement & bug fix update

Published
July 17, 2024
Last Modified
August 25, 2026

🔗 CVE IDs covered (11)

CVE-2024-28176 →CVE-2024-37890 →CVE-2023-43646 →CVE-2023-47108 →CVE-2024-1394 →CVE-2024-5042 →CVE-2024-24785 →CVE-2024-28180 →CVE-2024-28863 →CVE-2024-24783 →CVE-2024-24786 →

📋 Description

CVE-2023-43646 — get-func-name: ReDoS in chai module CVE-2023-47108 — opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics CVE-2024-1394 — golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads CVE-2024-5042 — submariner-operator: RBAC permissions can allow for the spread of node compromises CVE-2024-24783 — golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm CVE-2024-24785 — golang: html/template: errors returned from MarshalJSON methods may break template escaping CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-28176 — jose: resource exhaustion CVE-2024-28180 — jose-go: improper handling of highly compressed data CVE-2024-28863 — node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-37890 — nodejs-ws: denial of service when handling a request with many HTTP headers

🎯 Affected products99

  • RHODF 4.16 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:5fbef84c4a88ad4ea88a1b2232cc0d6630fa47c8e3ae874a485c971c6d5951b9_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:ac0c3a8d86539bc4668e1a6de82e1f8439a1fbbb17a3b4102cabf078f021b41f_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:c94f20ad65f5411c7cabafd574e52f2fcb52d2f917003ae71adc736028f962bf_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:088b9e19fc16a4fbb655b81ab1fbe78aa82ebce2ad5ad0df67fc8b361b4fe170_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:2c29d14c5d64f810cc68fdb894700819f5122a354d5cbb473cf73f517f5315e9_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:5c2628c9c3de8ff9eaf6c727eaa2b4382741f21afeb4154329714b404fb4e1df_arm64 as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:f4a85d993ae326570a5e4dd8bdf9e5cec586c2f8b55a962940457f39787d6af8_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:061fc659ec847d38201a7b049b813df1fddac1e97d2caddaaac3d91d5e05fd46_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:3cc0e4ec3f46d066bfc5546a2efdab3a44aa38f2d6dc961509bee8f7f9cb5ddb_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:7c00300daa75158d7a406317be71f2a8932a613b769144ae92a5ae225f4feb1e_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:193a773d4f1ed8ec6097579507dddd3863301ec546e325e38b5290235f06c802_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:968deb95e9fde6ba12565e3ef601bfc60551ac6ac7c122b2bdacea09b6574266_arm64 as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:d608a1d128733b31b552d8410c1d95cb740646cea32b79ee401d2de178e08ca9_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:f717a955a7ca2c3b1eac84e4b192ab38dcf1e98f6baea0ef592071c60f389bd1_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:46486b7e3b087bfec9c7b0dd4547af1190cee2be55dee7400ec90e6dc4b434f4_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:a20b4235cee3193794be549c645164c2811a044498a777591437ff440264a7da_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:a552dbccf217e8deaec318bcaf9b40877d3be1e88d091ae1684959f48367e0f2_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:8f650cf5915d5b7a15931e4a11d7c6be43d16068132f4cb4ef3e0c3e3cfbc17c_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:978017d3524aded83f4c63710e0b10dc2a453a22b5bc9ef801c7e70ac13aee40_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:9c3b15da5ddf22af93ae1617329ef41fddb4e6c00bbf9ea12567c4fc2c14cfdf_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:41c7883aafc2938852f5920ac2a178e1b0f39e0acdb817678696adec90fa2686_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:95a047d3be90468e15a9f246f8e0fbfd159f18f7a9841d07c75e6c3f30c7c80a_arm64 as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:d383069c5e89e051a15e95e61e9bd5197edf4f91fde60df8b8ed7d4e8269452e_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:f2ab9f9eb9e502f0d78b32159dfc5aeae77ec9698ed3a2aeecd184407388f1e3_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-metrics-exporter-rhel9@sha256:38d7fe0b8fa164df79d08fe2d20af60d7530e2691e7d4f183d71f138a00a128e_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-metrics-exporter-rhel9@sha256:a8f0e209e62e02a20648f982360e5b5ec7e62c294b4f7eb7df53ccd0bb750008_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-metrics-exporter-rhel9@sha256:cd6bbc33a59480c1c504a88f86ca4bb51de037db3c993581d18ee7e887c96dcc_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-operator-bundle@sha256:2bd43ed14d916a13f2d631f8dc350313c47619033134463399d76e77688f4c2e_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-operator-bundle@sha256:92c7cf4ce69644ffa955c78b1e18aab5f9c3a843f889703a326ea9e6697455af_s390x as a component of RHODF 4.16 for RHEL 9
  • +69 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: The issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. The issue can be mitigated also by seting server.maxHeadersCount to 0.

🔗 References (227)