RHSA-2024:6209MediumCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.4.10 security update

Published
September 3, 2024
Last Modified
August 26, 2026

🔗 CVE IDs covered (5)

CVE-2024-39338 →CVE-2024-42459 →CVE-2024-42460 →CVE-2024-42461 →CVE-2024-28180 →

📋 Description

CVE-2024-28180 — jose-go: improper handling of highly compressed data CVE-2024-39338 — axios: axios: Server-Side Request Forgery CVE-2024-42459 — elliptic: nodejs/elliptic: EDDSA signature malleability due to missing signature length check CVE-2024-42460 — elliptic: nodejs/elliptic: ECDSA signature malleability due to missing checks CVE-2024-42461 — elliptic: nodejs/elliptic: ECDSA implementation malleability due to BER-enconded signatures being allowed

🎯 Affected products29

  • RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:a22d6479a42218465760a1d69698becc8f9a52611b94dca2b0e6e6c4cd1f57e9_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:ad11189a25220c34fb540897fb45cf249594e7620c289bbe96bff12503ad93b2_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:bd78beca1f12e74496b8e50d102706a69fdb6761e5d27542ed215dffdeeda040_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:dcb3244a1174038bf6a15f5fa2af049051bc081a7954b5158d01ca62c1f4612c_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:34cde6f9ac5e0daabedd72d92bb7174f235f3788a5cd0da61ea02a4ed401d4c4_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:3b7c8f8ae92239b749c9cf2ac8eefcddc1709228fba062c13c1f08b5ada8948d_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:56eccfed504f353e9d93bcce4831454f78b42c22468c8c76bbd9f301db0302a0_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:8695969f7b7249befc05a5aa21872db62b62ce1d666dcbc46b413abaea1c8896_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:1174fe7492b61515788099876e47cf1ff1bc9f4acbd546bba11542d28d5633dd_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:5f4eeee81cf9de99fa94f3a30c18f16c8fb1d79f4758c7b558c7585f4d779459_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:b427b91446551d74f5602b6e644101f560885e580ca1e75dca38b752c031e7a6_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:dc3c46edf33bb7ce827f6bec3bc76a6381346e053471984fd0dec127284079e2_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:3b7c60376ce1df8a387f55e5f5d97778b0d7d4df7def6ac47fb4b1be8e38a20d_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:79f483dd161ee51e237eeb8f6c2b782fa4ffa01a63976529e09f5d43dfd4b705_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:b6294ac85755654fb6091a5d2b8456713279c263c9dbfac440ab0e6e41b40c35_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:bb7c59c89be24d5a763dee70bf1895175c8f14b8125774a6d6d7938ab164df6d_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:24eedaba1a0848d04af90278aaaba1a2790231d7049ed39047768ceed591f806_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:616faca6fd7684383ce8df2ffe0e0e72d397ff86a96a90096fa9bbb707736a64_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:d63b3d2356e504ed5e63fee770e71405e9efebaa0687ff95c72087755eb63445_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:dce09ee679578ab559f925bb6bc17746f71f38a5809bdebe2a22d548b1055345_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:52bfe29d4b87e59e34de3620a9c78e2a964d81c91fe94bca2a4e6b5ae6773ab0_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:6968e0f1a5034efb7c86248153573a3403ea8f7da1aaaa6cc2ee815a32958ee2_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:7e82f3597adb81ea86f8aaba8f7352bf20d5f533f948e5c86723871cb369e721_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:e63be81ffec6b125ae15a64b39c950e8b6d94c71fb3ebf3e59c36fd6a8708cd7_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:8b3c1cfa497893afa13413040ace41560f542136bfcc29fc4672527e646a385b_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:930d626158c0affcb82bd8f7ec27750b6cd58ff136498c806ecb9f01b59dd697_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:b23e1cdef09c9ec88d48969666b7646068cc811e0b9dc6f16df08ba372764ce6_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:ecf11409a26b7623eeb2d6a9928da13ef992e7d4e2cd9743b20a5a1a6412eb8e_amd64 as a component of RHOSSM 2.4 for RHEL 8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (3)