RHSA-2024:6409MediumCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.15.31 bug fix and security update

Published
September 11, 2024
Last Modified
September 18, 2026

🔗 CVE IDs covered (3)

CVE-2023-47108 →CVE-2024-6104 →CVE-2024-24786 →

📋 Description

CVE-2023-47108 — opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics CVE-2024-6104 — go-retryablehttp: url might write sensitive information to log file CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:15c96fae796148965a11c1121424dc2131bb580ca7b5473803eefabbfb95d96e_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:311a3352d6d0797a0b771c04f96159cee8ddfde0897f6e48821465557112ae47_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:83d5570a143b11280e3b10ac550dc0ef28ce4bae17d47bf97cea89e29605e749_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:dedea3f48ff7e74a9e51a8b240e18ffacd5ccb05e5e21b570ae287fcd95c5c45_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:2b86ba48749592d1b7b0eb446b5859906a663e2fe40d4a648f7cacaa5cc2c75c_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:3629c8b852a1b0e944a4609c430956654f6ab68aac137f9dc762606ba654cb3e_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:6ce05bef5ee9e112f2b148d88cf714a17e434cef32eeb6343643d2439f5cb309_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:aafd20688336752fa52ff3cddba37cc109aeeb5a3aac45e073d3523450559961_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:243e9f391ece6da7da003af52b403ec66a6b18547318035d2fc8d90fd1e82e98_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:b33653cdb5e512cd0fd46f9649e07fdfcb931e4e07d5017765467563364d28c1_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:c283654a605365393064bd43a2ba0740e4068e32e35253dc76df481049a4101d_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:c5449dfe1d96ff7201091ec63f8fc0652c35dc3ebc016146c91fb2d1359e2d72_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:00b1fdc5ec1df199a75805897c410f936f3af3a3f8468d1b1d161c5afba84752_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:00c59949716d6dbc7ae6d9c80d2b670fd2877db8114d88da99210e0d617f668a_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:2959bda99fe1f018bc04590c725ffec73b730f76d3534e0fb731869444195814_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:4ccdf9e4c43db8311bb46174c23b1d290cfbc59c687b5a9d0d9e59eacca21e8e_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:0001d4fd80d1f3cb5bcb73f0aa03821d19e4ddb7c1d6811331c486be943af895_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:38417e3b1ddf5474563f39d9e6b9bcdfa544412cdc6d4afbeed0de63a02f8764_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:55e91a494fdbccda4fe518a1f89e06b79047c21bc638cb34cbeb40c8f77be4e1_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:9c4b1da208b00705c3de8fe8ff141f3c2f279d6790c1a1808cc432408190adb1_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-alibaba-cloud-controller-manager-rhel9@sha256:efe4538c4ac1295a7439baf128d64b68b066b7ae986cfc7dc3f044e58d24c9c9_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-alibaba-cloud-csi-driver-container-rhel9@sha256:1c99fa0c761ffef1ff32b2368c48897146dac5af500f42c027072cf137575c3a_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-alibaba-machine-controllers-rhel9@sha256:6d4555f22509f84f04fd9c84faf5a72995abce02d33f4583a736eee35427704a_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:26846d76d897eec2ef7ff3c3f752f7d08fd0cf97217bf6d49299b6fa2a93d57d_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:57fdd2eea9bd443d2ee0af8ec0c6fe123c9c85d46ec1b33f059ac806d60e5dbe_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:6d1ac926eed2a017362da702c300c9894ef338202d59621d7fbf119f54347766_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:79d0eacc3d6ece5b4b4e4050d3440791fe9e1f191d8f6faefaca37ffd52ff45e_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-aws-cloud-controller-manager-rhel9@sha256:6937fba6935a302e054c62dbed195ace0bfb0b79e0422a97318bdd6545093635_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-aws-cloud-controller-manager-rhel9@sha256:8784a9788776e40310284be636e07d5770ea92f80ae6078fefcd91018eacd5d6_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:c03bbdd63fa8832266a2cf0d9fbcd2867692d9ba7e09d31bc77d15dd9903e36f (For s390x architecture) The image digest is sha256:638ce196a84d0a8a7d3beda6b9d688f02f9fb793595727bcc651e2d9083438b8 (For ppc64le architecture) The image digest is sha256:1e2744cbf6df478f4c5f9614d9e2f3640fd0ab643437b7a245f282635488ab1e (For aarch64 architecture) The image digest is sha256:a9788e396cc0df08dd23116e7fae4ef8b93b98a67ab663daaf81b95c28a1bdc8 All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html Workaround: As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (22)