RHSA-2024:7184MediumCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.14.38 security update

Published
October 3, 2024
Last Modified
August 25, 2026

🔗 CVE IDs covered (4)

CVE-2024-6104 →CVE-2024-24786 →CVE-2023-37788 →CVE-2023-47108 →

📋 Description

CVE-2023-37788 — goproxy: Denial of service (DoS) via unspecified vectors. CVE-2023-47108 — opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics CVE-2024-6104 — go-retryablehttp: url might write sensitive information to log file CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:21cc714a7f7e26e54e67e6aba64c797b66876fde3e78645daee85baa2fd38029_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:48cbc6f2486cb6ea200a91fca548bd8f0e5c50621f29410eb0e1c398cddd6b94_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:593a2983625e59137294354f73955139b1f23cb5e1cb8b72a234b30eb51eedee_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:a82e7ba69fd4e2c1a02217572d9d02074a96980731500808833ec57efec73dbe_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:34f62e8e9b462169f66d42549df5c84e209493be2233440aab661144f4c310ff_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:4b1cca65e9443c5ee54234f317bd8d1519e2f7749d6bbc8853655434f244b0b3_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:4de90d7dd56652b863405c2537880321c3f62f2b862093cec4f7e2c50a1a8738_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:d359a1172738370f07c7e5b3f3e19504f0548614e119de6165aa7425781e45b0_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:0150680cf3fe285bdc66d2268c1bbb9ad6280e43943b3ffafe72267282a19ac5_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:78d31e51caa8ee44759fde25fda33b36f76fc25e21456ff191b379715a1b3cf3_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:962f91ae22c8593f63e7ed70137f6bd09f94c175c89bd094033fdc99ea259e0f_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:9ea21cd68e62c23c03430373cb5320db24e19089f33f02ac63d7360ceb15a52c_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:04a70a021f343a7145b2d284511a5c442aa14876793b75932ae4a0cded5a95ab_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:9176c6991aa2ad6980883a30cf0f27952f30904569770ea03e84e2d5fe5d1655_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:e88a8d57f7e8f4af083bed9fd42b4570cf6e26b4b157dba225672424f431276d_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:fdf85a31d38d2225a09af8061b2abd5b7da3a5027280757f3a90a569c79398d1_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:4861afd147fb9e9987e8333f672763b427a4d5b90d7ed01a95f81c83b5bd33d9_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:58660a83320d24178e91721b2111275a5c1b00d6e9e76d49a185d5c93410d067_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:b7e5b5e650d0913b5d7ed0d80f6d25a5c6044adc557640f102c2103fc347ad26_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:cf37b710b3741160927beddd2f37a093395726d20734574f9c0ebaa4ebe8ca22_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:4a53315a5493d5032c5e5b533b80445341ec30201b6268845496e0796f5d8b9a_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:4e3662a0bcfb330afaf26a97a24d8cfbc71f4f663cd952a6ec36597fd9759cd4_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:a479062a752996af56b761afcb221bc6dbcd372acc2ac6e3e8f7175a5cfffcdf_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:ee166a7a362c2144f088413cc8cccaded88913e80c2db11ab5e291a69485f91a_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:0113ae9aa69099e3bb28ca6095a97b864b54786faa7b11f1c3e7979b03eba731_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:4520d254c86ea22b653111e3c4f1594ad2e6138624844099e9c25cee3df2ca7d_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:a9e5a61c2063ad24ddb8f799154ef57a79941b8e5b4fa8484dd49e30e574a45f_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:bc62629e2952897fa1676f8c4dcb9f40cce66c3d270b7b75c23e09852c78be12_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:3421473c33e5d345170242086187945ebe4f5f0e4f1980b18320665ed7896002_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:98e43d1e848f0ad303ed4d8d427e92f7aaeaf2f670a3bfcdbeeeaa591b63fefd (For s390x architecture) The image digest is sha256:4bc4c7bf583961d9fd9398833380db628039a0721246b6fef670760ad6e45b2b (For ppc64le architecture) The image digest is sha256:5e3f17f3d36b3e6196175ff4c82c520aad63415bdb5f508fb74f128e5849c9d7 (For aarch64 architecture) The image digest is sha256:234064b828f44eedb05add24accde60cd17ff37eabd89f7834b6b68d425ea9a2 All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html Workaround: As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (33)