RHSA-2024:6818MediumCVSS 8.3

Red Hat Security Advisory: OpenShift Container Platform 4.15.34 bug fix and security update

Published
September 25, 2024
Last Modified
August 21, 2026

🔗 CVE IDs covered (2)

CVE-2024-3727 →CVE-2024-7409 →

📋 Description

CVE-2024-3727 — containers/image: digest type does not guarantee valid type CVE-2024-7409 — QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure

🎯 Affected products107

  • Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:3821c2e86c2a4c3b92bccd07d5f23d8eaa4b0b679acc079dad3b758d3212c47d_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:46f64589ee219fe7390b8254c2c42627e675ec715765a425851b976ce51bab34_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:82bd4ae2a564ebc5c40b2b8f6f45826b432aa01acd463c07315d519654e7a6d8_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:9adf88240c48ec67ad538e487e626c9149d458c227f7c9812b8f8d3fff422e34_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:22ebb73dc07dda91930dbc04f2cedf9084f4151b8f3aa8c71ead821aa6f13bbd_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:306ab0a29eca3fb311b323f06c356e32514b8001740e81e2f59d7c6d07048a77_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:457ca38c35be7dc9211b875648923c914ae200719fead06406e20ac43cd79dd5_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:e6a682b5fc374110cd8a12c0c87518f3ad8a67de19050f459eec9139645d4313_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:6f21032bd94c725528db69cf22fa17ed5cb75adf3679f550405faf027a7cf16c_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:6f3d95627abfbdcf0b23fb826db5f5be06b747d912c7ef0eb3a024560bdea498_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:9f93646d4c83f25a801bf0b8751d740c4356bf04066c1b1787e6c3f9c441039e_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:c4bbd5124ea7d163179b557fba6a89eebb67f3d0225cb797db34e6df69fc6a3f_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-alibaba-machine-controllers-rhel9@sha256:a6f06be3ba9b157297698023901eafdbfea62d88da5b747da457a163a4cf6698_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:848d12fbcb24cf813f520e54df51e0427027cdd10bfedbbe6cbea04152c34bad_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:9b84bae44fdb936bb0276803d9eb3356cd16ceee6565c94472825903759df2e9_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:baed5f6291207856dbbf0f3e6b542e376f87a4dd47927185c666868821ce5a0a_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:ffa44b348d33fbdb74ec005b6e9d6b88771ec126300b04b763320d8f29fb2f25_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-cluster-autoscaler-rhel9-operator@sha256:14b62dff98327701dbc5c09f914d026ff61b59b439e7be0749cc0fb684880883_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-cluster-autoscaler-rhel9-operator@sha256:ba45499272c779ee2ce93f577220ecaed12dd254ebdd6fd54f527e08b6acd921_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-cluster-autoscaler-rhel9-operator@sha256:c75f05b4038d817373c7b7b30ad8c78731420444d4dc7b0dd95da74a933ad63b_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-cluster-autoscaler-rhel9-operator@sha256:e1ed50ea4a4e671cb5a6302bf553ee11709ce262d6852271fd6f0b3e6bc21c15_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:04fb8a760dcf566ef00953923061e3c461a484fea546096676c4bbc471349a03_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:5ffe9a6b89efa5924c21d696c2c3f6e4ffacdbbd01876f4b775aef727cc76614_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:b0ceca5800bafc7e4819968689c923325e37c78c4780dc574147aa24cba20f1e_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:e717fe406b82bc073dafd4cfeca41c9821d3903fcf5fb0b428ffc6f3253686ff_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-cluster-ingress-rhel9-operator@sha256:992bed2ef654d404bae3d6158b7fb30cb1776cae186a516000a27e010f888268_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-cluster-ingress-rhel9-operator@sha256:b084e2f1d30983b7d8cbc4e5ddce68c78a659903483ec9bceb111d531e65c27e_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-cluster-ingress-rhel9-operator@sha256:c24b331cf6b820132d7258262929d6685d4435084ca2a045cecf0135127396db_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-cluster-ingress-rhel9-operator@sha256:f086abd9b778c97c4d43d0705b0fa5dcb9d72d3c0a3918768b583f71e9b4fbc0_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • +77 more not shown

✅ Remediation

For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are: (For x86_64 architecture) The image digest is sha256:f2e0c593f6ed81250c11d0bac94dbaf63656223477b7e8693a652f933056af6e (For s390x architecture) The image digest is sha256:357949b571429fc187fd9f80766ca730de2b8fe35b0bfd10a604958a1756c754 (For ppc64le architecture) The image digest is sha256:e95ac38bd9f3189f2f4acaf19e10c10ad5f01ac9921e54b418410441ed927eb0 (For aarch64 architecture) The image digest is sha256:4fb3b9374aa74dea5e568d584fc3f09220ffd9a70f4c39eb11d822a69d647220 All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (20)