RHSA-2024:7324MediumCVSS 7.0

Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.9.7

Published
October 2, 2024
Last Modified
August 14, 2026

🔗 CVE IDs covered (3)

CVE-2024-6104 →CVE-2024-45296 →CVE-2024-45801 →

📋 Description

CVE-2024-6104 — go-retryablehttp: url might write sensitive information to log file CVE-2024-45296 — path-to-regexp: Backtracking regular expressions cause ReDoS CVE-2024-45801 — dompurify: XSS vulnerability via prototype pollution

🎯 Affected products43

  • RHOL 5.9 for RHEL 9
  • openshift-logging/cluster-logging-operator-bundle@sha256:3b1f61f40556c931ec5bc8a99a6c7917bc5cb7dd6fe13ef8cd2603882d0eee58_amd64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/cluster-logging-rhel9-operator@sha256:81429833f5eace1ed0551c24e36f4b62e6f8e636b0aaa9d51ca631bd38e39d55_amd64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/cluster-logging-rhel9-operator@sha256:c6bad5602c46f96702e1a8229d4cf2d0a52448b52921baf956be73d13b17238a_arm64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/cluster-logging-rhel9-operator@sha256:d141094a566076a1a6446432d879e3d2d04a9d2d4d6b312329939b149edefa74_ppc64le as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/cluster-logging-rhel9-operator@sha256:da1b89713f57187a47e213bf2327253d4b86f67a1782542c50d53a0aff9fb32d_s390x as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/eventrouter-rhel9@sha256:1a8036416fe14318ef86d4c5c647fb9fb0df1b46a5d49f3e814a2502e026f6c9_amd64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/eventrouter-rhel9@sha256:55bddb959a24589db81c899b763d93e52d39c03e949341ab59139af4646657d7_ppc64le as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/eventrouter-rhel9@sha256:b873cbc4bfff8e599afa0adf773a62f1e4884d1199dd3c42cfb1062ea064b0e1_arm64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/eventrouter-rhel9@sha256:e1390da0cb3e5947d394bbff3fa1df521a26c5be01ea829024a28cc4b960d14a_s390x as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/fluentd-rhel9@sha256:473a6e8f3f9b879038eeffbd9ea3f1ce51fd30e2614598f5ed96a9699e1e0840_s390x as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/fluentd-rhel9@sha256:6e3aedfb93fb759ebd5e88d6fcd5b7733a3e64b86bcf33569cd8abd833ca5317_arm64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/fluentd-rhel9@sha256:87ee3510ca2eafafc914fbafb591d871757ebbfe6ff1765b3d448c3fa1f9f1a4_amd64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/fluentd-rhel9@sha256:e39aeb29fead7c4899b76b9fd90a03b49875de0660dc0f701885617c4ebd2ee5_ppc64le as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/log-file-metric-exporter-rhel9@sha256:0e20cce12cf234424ba883d582e4b5409d5abad895ea1411ed94400a919efa26_s390x as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/log-file-metric-exporter-rhel9@sha256:165d702c6c6a3f882ac7b413510cb119239ad338012a58033ba9c80757ee6f0d_amd64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/log-file-metric-exporter-rhel9@sha256:8a3d87c76ccca2710d4009c483ff3849c0db0097134bf522eedfac20236b72a3_arm64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/log-file-metric-exporter-rhel9@sha256:b4e6a62a9711825f16d61bce5ce8926773671aa0fa826122a0a9cc7ce0a35f04_ppc64le as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/logging-loki-rhel9@sha256:35e06a641268891b41c419e7471038eaee91cb8a4807e1ad2052832a053d8044_ppc64le as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/logging-loki-rhel9@sha256:4f887ba3569acde13bf34fa86cd8e2899281f9d4efc83f6ddaf18cc39f9b8f24_s390x as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/logging-loki-rhel9@sha256:6ed9df1170b26d52fd6fd825c4f80603e6e481e1d0cfad67cdc8f68ffb10cce8_amd64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/logging-loki-rhel9@sha256:f6664dc6c451fae94f44aa48b7d7d33f57f5fde96dbddb9717f00865a26c167a_arm64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/logging-view-plugin-rhel9@sha256:656f64a6a55c116fd22046faff1ffd218ee849342e69a4eb6c4b567e8c21ccd2_amd64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/logging-view-plugin-rhel9@sha256:96f3970d474e6853cdb8f0ce1b9eb30b71063f8968d573d6593a45b3bb2d1775_ppc64le as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/logging-view-plugin-rhel9@sha256:aceefa76322cf8571a9a8b12fdcba70616fa2bc9f148223fe571505717b10f88_s390x as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/logging-view-plugin-rhel9@sha256:f0c4675a9fe55da1289949cc94f2fdc086007e1d72a12a8af2340fcaed8e9bf4_arm64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/loki-operator-bundle@sha256:a0f8da449df26650a1b5f0e756c91970702158fd4336c5c8b6bbef68d944eed1_amd64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/loki-rhel9-operator@sha256:2139b6fe5592c6591241c177ece47489be7e1c074f4be0032bd69c6075a06560_amd64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/loki-rhel9-operator@sha256:a248f058102d9c31b0fa625a3ec6571ed707039b72186c1bb2b72d5dd5d76aab_arm64 as a component of RHOL 5.9 for RHEL 9
  • openshift-logging/loki-rhel9-operator@sha256:ce77679763582b1d79a0b1873ccad041c390f66d2b2731029424fd71a929c68a_s390x as a component of RHOL 5.9 for RHEL 9
  • +13 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html For Red Hat OpenShift Logging 5.9, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.14/logging/cluster-logging-upgrading.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (6)