RHSA-2024:7594HighCVSS 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.15.36 security update

Published
October 9, 2024
Last Modified
October 15, 2026

🔗 CVE IDs covered (2)

CVE-2024-2961 →CVE-2024-44082 →

📋 Description

CVE-2024-2961 — glibc: Out of bounds write in iconv may lead to remote code execution CVE-2024-44082 — openstack-ironic: Specially crafted image may allow authenticated users to gain access to potentially sensitive data

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:047077ea75d21967a3c2c458efab3368cd7f9b7224f377af8ab2fd692390eb0d_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:71a665c94a45d289bb8b5e75500f3ae20e0a8dc3ca538f01336c96cbdc90899e_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:eb812f83752ca6b6fcabdd6111e10ae58c532ad2a0363f51ed7c9498b573f433_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:febd230635fddbaf2b4d405d8bc8005d681d58800f57937cb0b30bfdbd69e8c5_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:6f30d8199b65924e63261c4170d826ce8b9b0ed3e90d7207337ba6f536222fe4_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:cb1e8c5464362d9bac04775c0639065ee2c1d335ebe6414705f6e2d66c5ca669_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:d34c04432861d4202ffd01e6397f7b601519757a85212c01f53c7ad9cb42881f_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:fc867e3bfad4c27aecd9d57c0d1002bcd86966a234cc5feea31c4cf26646b20e_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:2e4071d7f2bc3711cb8b4c5be741514a9fbac0e7d80798369b74b347a329c413_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:5b82b6ba67383821ebad11f5c8791db501bf6796ec404118d0af1cf670fa0446_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:67a7b4697596a3ef9cfa792f1ba5d5e05f55f6662c3e34c78f83d5f3045d6996_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:f1f8e6f4092fa60fcb1121463d2692e8e09f9520abe9406903d3cd8d7d1bb0f9_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:3d630196d4ea8d7cc3edcb688e94fa3897c0b8fbbeebf48c581b44a2bbd2a711_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:54a9326bf459b779ecb1cfba44f45b55bbbb233e7ff854f289b0bddc46f1477c_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:8bb2df2fbeca446c0afe67dc049fdca3b900e682d908f27fc0dff709ba02a46b_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:a255daf3d734b293ff25a1a7b944bb9ce174d4009e65314b336e1a2a60f35c43_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:61311adddae92e4d677f78fd9da415a41799c483fb72032d4e2b526f1b634dd6_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:770fedc2c290ca62185a4cd5c2951b88599d018d49b20e60a38afe06565e399c_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:aac5672a137ac51f31ceb538438b77d5fead31094749c8aa5afaf412ba0474c6_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:ecac0a3ea7dd2dad35cb29d3e82dffaf40989fd0659ca58822ba38290fcaa552_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-alibaba-cloud-controller-manager-rhel9@sha256:44003d7d66370a8b12f0429eecce7ff30a872d6998db52d62889bcf81dfa59e6_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-alibaba-cloud-csi-driver-container-rhel9@sha256:2ede7f406f8c08c680959340c00b3d6549acf68f0ea08a7d0d97f166b5ffb745_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-alibaba-machine-controllers-rhel9@sha256:1c63449a058e94a11da80df79d461fc56efa8879d2418082dc18847ceecf60e8_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:75719921b5de86f813752f08b72ee93afcd5bd8fb3c00f53ae1f2707cfbed3de_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:9cfc99f19877240b6f474e3ae264a74743332e114ef11acf936fb15ab0ceecbb_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:e05ff1f0fce4e57bf6e8fec3ee386738942d1a599426a3263e4fb8edf1dcc14b_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:ee44632defeef9a278d2cefba686d97b486c94f6546e83de33f83935914842ee_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-aws-cloud-controller-manager-rhel9@sha256:00770462ef6fa3a170966fd42add5ee8e3d933cafecf7f6763e63cdb45ba37f5_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-aws-cloud-controller-manager-rhel9@sha256:74e6073f1c7f778beb5c00404a69f8b271c9b773668afd4265a0eb16ecb02ac6_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:a8579cdecf1d45d33b5e88d6e1922df3037d05b09bcff7f08556b75898ab2f46 (For s390x architecture) The image digest is sha256:97feeb7d2f5c94803257805b9fd440456f9f8603a9e3a9c212db598f3fff4a52 (For ppc64le architecture) The image digest is sha256:bdc13e27cc05ccff66e16ef6a34a998a4e2f40a5f8b524c9639f0df8e26f78b5 (For aarch64 architecture) The image digest is sha256:51e67caab0da8687b6a72accfa8d2d7981a4673f720cf68d95a553dd2c66f559 All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html Workaround: This issue can be mitigated by removing the ISO-2022-CN-EXT from glibc-gconv-extra's modules configuration. This can be done by: 1) Verify if the module is loaded by running: ~~~ $ iconv -l | grep -E 'CN-?EXT' ISO-2022-CN-EXT// ISO2022CNEXT// ~~~ If the grep output looks like the above, ISO-2022-CN-EXT module is enabled. 2) Disabled the module by editing the file located at /usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf and comment the following lines. For RHEL 7 the file that needs to be edited is /usr/lib64/gconv/gconv-modules. This step requires to be executed by a privileged user: ~~~ # from to module cost alias ISO2022CNEXT// ISO-2022-CN-EXT// module ISO-2022-CN-EXT// INTERNAL ISO-2022-CN-EXT 1 module INTERNAL ISO-2022-CN-EXT// ISO-2022-CN-EXT 1 ~~~ For commenting those lines just add the '#' character at the beginning of mentioned lines: ~~~ # from to module cost #alias ISO2022CNEXT// ISO-2022-CN-EXT// #module ISO-2022-CN-EXT// INTERNAL ISO-2022-CN-EXT 1 #module INTERNAL ISO-2022-CN-EXT// ISO-2022-CN-EXT 1 ~~~ 3) Update the iconv cache by running: ~~~ sudo iconvconfig ~~~ 4) Check if the module was disabled by running the first step again. This time ISO-2022-CN-EXT should not appear in the output. Please notice that disabling the mentioned gconv module may lead applications relying in the affected module to fail in converting characters and should be used as a temporary mitigation before being able to fully update the affected package. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (17)