RHSA-2024:5547HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.1 bug fix and security update

Published
August 19, 2024
Last Modified
August 19, 2026

🔗 CVE IDs covered (4)

CVE-2024-6104 →CVE-2024-24788 →CVE-2024-24790 →CVE-2024-37890 →

📋 Description

CVE-2024-6104 — go-retryablehttp: url might write sensitive information to log file CVE-2024-24788 — golang: net: malformed DNS message can cause infinite loop CVE-2024-24790 — golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2024-37890 — nodejs-ws: denial of service when handling a request with many HTTP headers

🎯 Affected products99

  • RHODF 4.16 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:1fd2db3d141cc063c6557000c8b1be2425712dc4262240c3c9195d8980772191_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:cbe15eaab7f10fe9b4c9bfa6e3d1f0351d8cbbc27d5d96627e11e9c861da29d9_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:d4177d019b86fec5610d852b8b90e6464190969e75de9172f2f252c26076d40d_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:52b894a194732eac846c63a3669b128d6505b8b944c60cf1ee07c7daa201c9c3_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:b4e552db7dcd293fa421aa6ee9c6e91198c6be6dea70addcbd6c12687509631a_arm64 as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:bae697a9acabba4a6ef4b4a16ecb17e102bb4bb8b1c05f93a806701c055bc3eb_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:d293b85fa2d8a749f802ddba16f4f6ed3dff5c8d7b0b1cb56527401da37772b4_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:0321e7c87a5a64fa0936584badd2848e79c0071800f596b7d177fcc68553bd22_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:3d8a3e1cbf57c99a46d0901a1eb6f00f7a957b90a7868d394785e446f643c5ca_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:833c743bef3449dce3c0521590dfbe5e07105dece7f6c8e08dc4d1d402905d7b_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:3ef8732d07e7a5ce8d8decdf01c46924f93c552e82d7805a251bfe368b62c6de_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:7ad5dc366963e89022aacc0f8be37d16b0e63dde3ffc7dc49805c300ee61c496_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:aab65b61fca5ff87dfdad973928df8c22c6231c14b838063bd2d44e4f16fe744_arm64 as a component of RHODF 4.16 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:d817e724ace3b1b6e05614499c0cb635b567dcbbc71f619d6f41cb85c4b34744_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:6f71bd3411a04389d302e863acd5351e753b614f4f077aee0274056ce23739b4_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:773c39dc89b6b4cc82e4c78f50d4fb16bd70b611efcb65ea4b767d98fea4f7e3_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:7f6c46935a8eab7e09333068aed758aa275b9d5fd7282f15b5fd85070fe28875_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:8129b7ae939cffb029ac10631d29c6ea081928c4f42ee7ba7de91f3a6f6bf7ef_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:be27d3e25035448bcaa691658adeebeacf582d8f19db3e997caab33cf6e8732e_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:ce6105258794e33e5a805a95c21e9f553922e1753076345aedcc9174fa4f7d5b_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:09456ceabf9dd2f05837d65632a920f537e36695e7342ae70f20c363284859ec_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:95faa45331614593c4b6e3994656d7fde32476598ef46ec0b9cff5be02483b90_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:d19019a22f7611ce91c582c3294693eef2cdeefccb72f230f8e37ff111272c53_arm64 as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:fdd7c5a2cd69132f5caf4974ed27d49f78f49208ecdedec86d84b7fbdd306994_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-metrics-exporter-rhel9@sha256:2b0078eb2656243a6d91445c2c23a40af9fb2607f107edd5d557e928518211ce_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-metrics-exporter-rhel9@sha256:8e9371822e053e7a29cd87853feef39ffa782a626a2bd895a7fb506362d70561_ppc64le as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-metrics-exporter-rhel9@sha256:e0f9bc46a2c99eedadeac36117081f1d0e1cf6c979e1162cb0039540e286fbb0_s390x as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-operator-bundle@sha256:3d21dd55a83990ef51325c636c0a613ee5050a4b8b2708bc1bb1d8de1792166b_amd64 as a component of RHODF 4.16 for RHEL 9
  • odf4/ocs-operator-bundle@sha256:748d2241aa0c3fda48079434de8f2938013853a492f96a3d83dbc6ea3f977189_ppc64le as a component of RHODF 4.16 for RHEL 9
  • +69 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: The issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. The issue can be mitigated also by seting server.maxHeadersCount to 0.

🔗 References (21)