RHSA-2024:5054HighCVSS 7.5

Red Hat Security Advisory: OpenShift Virtualization 4.16.1 Images security update

Published
August 6, 2024
Last Modified
August 19, 2026

🔗 CVE IDs covered (2)

CVE-2024-24786 →CVE-2024-41818 →

📋 Description

CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-41818 — fast-xml-parser: ReDOS at currency parsing in currency.js

🎯 Affected products109

  • CNV 4.16 for RHEL 9
  • container-native-virtualization/aaq-controller-rhel9@sha256:042da8264d3600e96d1f4628bfa77f449c10ab28c8d2a73b1b8654a2832d5ac8_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/aaq-controller-rhel9@sha256:c6dd6c120d336563ec7bdec6b44e055ab71f6da06e2cde8e0325eea59e3b9b8e_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/aaq-operator-rhel9@sha256:913c45495da29bd15182960564287833095f039858c65730ed581743465d0b18_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/aaq-operator-rhel9@sha256:ec80c6380adeeb2449fb3a3995b634dcc1a5696f13920f601834a6a4dd0521df_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/aaq-server-rhel9@sha256:833eaac61b9397e7df2c6b4b45c313c8417724ac695ac49083372cd46c92201e_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/aaq-server-rhel9@sha256:df44034602ab58f64e04e62c35f708837e15504bd1b828db6a084f83f9d475f9_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/bridge-marker-rhel9@sha256:87b148774f7657714171259f8aa0848b91a5ae648ca7350ff48c41c023808515_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/bridge-marker-rhel9@sha256:ec7e380a004d3db61dff340d239cbb6b6c389a2854abb5c7bc4a37948d45b30d_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:3af68670b0ca7cb23b4ba88883c94630c80fff2856dc58c7f0f4b762be66936c_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:a9caa05f7569b8d37e37955c2f6cf5d4a574578357a3dcce960fdf9433a610e2_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:4cdd7c4aae7e4596404c1a1b4d21baf4bfd6cc0f0454e2ddc5ce2f06e575d131_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:a9138a876a434f033f3285ced678640ace03ec9d03954ccc61f0235ea7af2485_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/cnv-must-gather-rhel9@sha256:08251c634fc6005aadfd41e1b50644b636f1056f63810420aa30fc2afce6d7ad_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/cnv-must-gather-rhel9@sha256:552c767b0db125264fdf3b63f713e1df40a38ed77f1efdbf20056ea49dbda038_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/hco-bundle-registry-rhel9@sha256:71eb7aa6d3899f33c1e4874e8923789dc6bde76d1d2c3966d00c2dd0e7dabfef_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/hco-bundle-registry-rhel9@sha256:83ef682fa0f2ecfd3334c59ffb711032f89579de40fbc402ca739c17b43cb4d1_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/hostpath-csi-driver-rhel9@sha256:999ad3745db5c497de241d07a692941c90c7f87861cb6a12353866936bea6204_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/hostpath-csi-driver-rhel9@sha256:c76b798c4cffe32501dcbd1013df47b0208775f5bc5a59e3685d354cf56326f7_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-operator-rhel9@sha256:3baa3071b3e1c1c6ff730b4137be40bb509ef0b3c001f43c96dc7a958eefcc2b_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-operator-rhel9@sha256:aec20b4941293b815f692495facc6e96b9255ebba1f125007af0685f04756a35_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-rhel9@sha256:84470810a6172b419603792ef9b936f0f27e38fd98d8d31281acea788e3674ec_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-rhel9@sha256:95d432fdda7a4dec7d91496a1a2829951d26b78f22588135d9841b54c19a7749_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/hyperconverged-cluster-operator-rhel9@sha256:bef9771161b5b04d21d056356c46a2755903fa5155e1cf94c6366737f9bf87db_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/hyperconverged-cluster-operator-rhel9@sha256:d25b36304b33b5d90c906876e646d684f71de4142a35a4a1831c74957eb771ac_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/hyperconverged-cluster-webhook-rhel9@sha256:aefde2560258338c5a2d8e5bcb30f26a6f52401066dbaa9a8513d02941471c67_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/hyperconverged-cluster-webhook-rhel9@sha256:fdc9c626f7dffafacd26160f6ab3d90fd857218f4b34e1db79346b5dbb2ef984_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/kubemacpool-rhel9@sha256:17f725d394a4baa8bc710bf53fc09feb67f79ffa7aab99642891132429d07ac1_amd64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/kubemacpool-rhel9@sha256:6d5c8abaf206733d00ee1f56bac5ed93536af3a09a02f1467d82daefc87d2808_arm64 as a component of CNV 4.16 for RHEL 9
  • container-native-virtualization/kubesecondarydns-rhel9@sha256:00c71423f17003deb67681552c1031145a51f1f720548927d84bd5e61c23f657_amd64 as a component of CNV 4.16 for RHEL 9
  • +79 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (24)