RHSA-2024:6210LowCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.5.4 security update

Published
September 3, 2024
Last Modified
August 26, 2026

🔗 CVE IDs covered (4)

CVE-2024-42459 →CVE-2024-42460 →CVE-2024-42461 →CVE-2024-39338 →

📋 Description

CVE-2024-39338 — axios: axios: Server-Side Request Forgery CVE-2024-42459 — elliptic: nodejs/elliptic: EDDSA signature malleability due to missing signature length check CVE-2024-42460 — elliptic: nodejs/elliptic: ECDSA signature malleability due to missing checks CVE-2024-42461 — elliptic: nodejs/elliptic: ECDSA implementation malleability due to BER-enconded signatures being allowed

🎯 Affected products33

  • RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:0e5a5f9e98b1181a4624abaeae779a52a9f23b885bf5c49b501cb89b47ea57e8_amd64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:650a7a328845a5614844e5121d3fb643860f851985c263759d8b3fc4d3837fed_ppc64le as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:880dc5db1971ed397af223519a8a43b513dbba90eae5fd09f173b0051f159c22_s390x as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:a64c67b2bb9cddc99836dd93c169043b3ee048cfca7d7ad4ec28fada75c3240a_arm64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:30451a29ff2f14bf8c4f210ebf000679ce0ffa4af5fb6d7e931402ca4c0698f6_s390x as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:3c32da67d342a74b171f28049ff997014ed7ba4a9a63bcddf1bcd4761df91d6d_ppc64le as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:4de88f118f7f0f9c82dedb534d2201a969a6eb7129862fbe99d977619346a91e_amd64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:7e8ec2e701f32afd8502a40809cf7d707679cfc7bced4b7545d4c828617809ba_arm64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:10a472f7556e95753ed1ed78e68107539a4fa21edd99c5c971442ad9f8ea6160_s390x as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:2fa038769856650e23d56871f3b9746f82f7b1d0ae20287779e4d8c895642212_arm64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:95a0d1e8765e6e983635c0ed5e7ba7c5ce8deaa3f702d41557b7cce20755f997_ppc64le as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:fcceb12b4878f180a9e4263c22e04a3b048a88951b9b4dbf735dc59bbe92cedc_amd64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/kiali-ossmc-rhel8@sha256:55220093363a18cdb2da2183df4c645831c20a070fae3ffa8ddb163cd1a0dd1c_arm64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/kiali-ossmc-rhel8@sha256:9e39df1296cd22c9ee4c9fe291bd8d2555466d212a32047b3f6c64ca993563f0_s390x as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/kiali-ossmc-rhel8@sha256:ce777a4c38bef7988300446caaea03e9eef9ea6e5260a9558e09af81a9b866b2_amd64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/kiali-ossmc-rhel8@sha256:e12ca81c2bf4f7d29444833e92a06eec5da433e931803e89c5315fa61afa0f04_ppc64le as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:68588cd4073be83b9e42fbde29656bbb9e007b53c47d1b943d19aebe624e61c1_amd64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:8a1dbff7cea816ea96546e6d1647b5ab439c85ec2a76c3d74dadb462da71000f_arm64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:c07e3a2ac395e06468105553dce097334f262c3f94d96cafc500660ed29eb91d_s390x as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:e2be27500e84f830a79c1a8f141d9efb33bd02464239e5611b6e1aafa82af302_ppc64le as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:0ffb28605471f52ffb11c090e3ac49c58ee96a6dc4fe13d851ee8a647e413f15_amd64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:28dd159630562c2cf106fd9c90ee2f0eb6c27eb20f44a0ad89aa62df28ba5686_arm64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:4346d91114d23b5e794c67fff10560730b51a38376cdbae0787c4d9cde7a419a_s390x as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:977f445a5a4e5cab65df2ea078ff36b58c25198ee914e5aa7e91533e1d9b7cb5_ppc64le as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:30735e400419bb8c08bfcdc302d3ab97786e7825e89f604e3f6a1f42d727e3ca_amd64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:99cdf691126ba1bd8c3f0279a95dda1c8c76fe257a72f59a479a926a0ac7eba5_ppc64le as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:cbf2da4bfb39ff37c0028bbcae621b5e8e37e32f8b7c622139fbce3f1cc0f8de_arm64 as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:f4ae7819aab6a853500b54577955ec9433280b1d839b145971a3a1764a59b52c_s390x as a component of RHOSSM 2.5 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:1b33e9cab1b582ad850c95a008c23065a917a53b82d540680884da19e12b99b2_amd64 as a component of RHOSSM 2.5 for RHEL 8
  • +3 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (4)