RHSA-2024:7590HighCVSS 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.12.67 bug fix and security update

Published
October 9, 2024
Last Modified
October 15, 2026

🔗 CVE IDs covered (2)

CVE-2024-2961 →CVE-2024-42353 →

📋 Description

CVE-2024-2961 — glibc: Out of bounds write in iconv may lead to remote code execution CVE-2024-42353 — webob: WebOb's location header normalization during redirect leads to open redirect

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:0eb09cff9e29caed0e7e64932f09a5d8d517a1a0c09703a55856cecd0c835135_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:8b1f93c8becd979567f3d8900abd2bd5c3d352d1853e597128301ad9e0884c5c_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:99e552a8667efe92db945fe7dc9e1f49c81fab2c7496e85e4fcd00c493adef93_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:a175e1f86fddaca7cad3c44a8ce3224506710fe95dbb5756d1a2346f39ada387_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:204af7fa33c2e5dfec0527f21ae38876df66d7069fd4e6fbc91e031820dc9d35_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:b62a6b49bee7f4d28ea549e0ba4243d653b890fd891e4d827d00b0c66962414d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:614f356bc894c1f4588385398aeccf1ec3d07fed1053faf841fae9d155038273_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:847504f2960945878c801b2f005377fb8b528c0fefb112780e367250b17140df_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:06a22a2e8e3c25a5e8efc29ee80a9d2a33df3234b2460b9f81b90466a45d6a84_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:e152f6deb74438a88af428b140dc20482449c3deed42c4dcaef266a216067719_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/oc-mirror-plugin-rhel8@sha256:f178166c57cf9c504dd7a85fe0d8125feba40d4b93e9b19e2b391072f9e22898_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:350e478f186165f9d7e5ac6e629eb4ae6f068aaa609d2bef4b904fe7062d9b79_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:a068bd8a5c28aea059b1933b165cad57d11506490dc839eea0a7fc127289f562_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:3b44ae79fb39d1f4c5236958f489b9f9cc7120ff5bccdb52f3a31ab47e4f8023_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:471ec47664b0ba3beab5f4464924b0f5008d13ef281b486530a260821fcf9721_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:1e15bc8ad61641212511edc70e8ae6984d87e7bd65f833d5ef03f0ea71439bf9_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:2bd456d016a25548bba0db51694c6e57bd8d99ad9ade1bc49f21ed1f8f14e025_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:1e4a27a057410c9cc811c22880de4a77db107570c8a42e03694466a8597c7f63_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:68fd8e58264b98803675f28c74973934ad6746bfd5018b2b5d25c4eab4e6e5b3_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-orchestrator-rhel8@sha256:841b73e9f4c44fafcd53b84e8e9b43fe128a6dcbf0071ccfc85e4fb163c85e73_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-orchestrator-rhel8@sha256:b3181721e8759490d2cc1ff8e327276ff796b2ad9014536c7332dcdab423ecdf_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:e18feb89eeaabec6818905d5f1fe9a031ffa3e37369c7470078cfc5596189c2f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:a1bfa1ae5eb77519a5ba4e642ef34ca585734d7093bf3da3b565afda0a2abfd0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:1a400cf12cfdea21872b5296c550b1e71823c0b251e17e93f1de88824ae38035_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-machine-controllers-rhel8@sha256:c448ca72165310e1c29cd4c2d29f5124c4cc4c04cc412e445b23b7694cce8f38_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-apiserver-network-proxy-rhel8@sha256:07869a8cd4996ceb748b5bd940e51b07558c9b27da78842d80fe6615a429408c_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-apiserver-network-proxy-rhel8@sha256:2fbcdf18ce21acfd027cd2581aed5b645be902caf55b760cbf4ece00c8d92992_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:95f90df89b8f1c115c98540c0ae5c746c269070722d6850ccf4c2302ebee1755_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:a0e1d4f192a383c52ca2552b57838e3e55c15277a565ccd3031fc2c5ed1cd770_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:d47314d7bc5773444897949b7e48031670320bf794d34a4766d36343b2105a09 (For s390x architecture) The image digest is sha256:c3b9ead5eedfe5481f36b20459c75aa40be929b954aac42b06b3391d26b2f01d All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html Workaround: This issue can be mitigated by removing the ISO-2022-CN-EXT from glibc-gconv-extra's modules configuration. This can be done by: 1) Verify if the module is loaded by running: ~~~ $ iconv -l | grep -E 'CN-?EXT' ISO-2022-CN-EXT// ISO2022CNEXT// ~~~ If the grep output looks like the above, ISO-2022-CN-EXT module is enabled. 2) Disabled the module by editing the file located at /usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf and comment the following lines. For RHEL 7 the file that needs to be edited is /usr/lib64/gconv/gconv-modules. This step requires to be executed by a privileged user: ~~~ # from to module cost alias ISO2022CNEXT// ISO-2022-CN-EXT// module ISO-2022-CN-EXT// INTERNAL ISO-2022-CN-EXT 1 module INTERNAL ISO-2022-CN-EXT// ISO-2022-CN-EXT 1 ~~~ For commenting those lines just add the '#' character at the beginning of mentioned lines: ~~~ # from to module cost #alias ISO2022CNEXT// ISO-2022-CN-EXT// #module ISO-2022-CN-EXT// INTERNAL ISO-2022-CN-EXT 1 #module INTERNAL ISO-2022-CN-EXT// ISO-2022-CN-EXT 1 ~~~ 3) Update the iconv cache by running: ~~~ sudo iconvconfig ~~~ 4) Check if the module was disabled by running the first step again. This time ISO-2022-CN-EXT should not appear in the output. Please notice that disabling the mentioned gconv module may lead applications relying in the affected module to fail in converting characters and should be used as a temporary mitigation before being able to fully update the affected package. Workaround: If the Response class is used, any HTTP Location header (i.e. location) can be rewritten so that it always passes a full URI that includes the hostname to redirect the user to.

🔗 References (11)