RHSA-2024:7726HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.6.2

Published
October 7, 2024
Last Modified
August 24, 2026

🔗 CVE IDs covered (10)

CVE-2024-7264 →CVE-2024-43796 →CVE-2024-43799 →CVE-2024-43800 →CVE-2024-45296 →CVE-2024-45806 →CVE-2024-45810 →CVE-2024-43788 →CVE-2024-45590 →CVE-2024-45808 →

📋 Description

CVE-2024-7264 — curl: libcurl: ASN.1 date parser overread CVE-2024-43788 — webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule CVE-2024-43796 — express: Improper Input Handling in Express Redirects CVE-2024-43799 — send: Code Execution Vulnerability in Send Library CVE-2024-43800 — serve-static: Improper Sanitization in serve-static CVE-2024-45296 — path-to-regexp: Backtracking regular expressions cause ReDoS CVE-2024-45590 — body-parser: Denial of Service Vulnerability in body-parser CVE-2024-45806 — envoy: Potential to manipulate x-envoy headers from external sources CVE-2024-45808 — envoy: Malicious log injection via access logs CVE-2024-45810 — envoy: Envoy crashes for LocalReply in HTTP async client

🎯 Affected products42

  • RHOSSM 2.6 for RHEL 8
  • RHOSSM 2.6 for RHEL 9
  • openshift-service-mesh/grafana-rhel8@sha256:239b42c643b37c7aa7de38e9eeb00222e9dcc8e96b845307c73ecb48ec8f6175_s390x as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:26d5dec1bf366dac99df61dd31cf8a6a6937b4e81d1d61a3b3b57e7bf8ee3375_arm64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:58760b14fd38690a490f7a5ea01e44c5ceee193324488ed4016203c042f88e7b_ppc64le as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:a50a14787a8765c1c9da772d58d08138cacb29ba41e32bc3f5c0ff9b8452d40b_amd64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:3c5142ebe3cb9c77b67c29fd7a6fb6b5176ace9833f69aaebec658b4ca8232ad_amd64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:b72249b5326e4606f53a0130f099ccb636241de275891f98e0a622c8db1a4c9c_ppc64le as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:c5562019a94ccaa070d4c2107b992847ecfdee49c1f4dd3043e3c20307b74112_arm64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:fb11daf6c17ea22d9b80af3f2b48807a00e73a347e081f046beb5707923ea976_s390x as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:32d02294f6c3ed5ee704852afb31a98777eeae19fa48f2cfbfa0aa17701eb025_ppc64le as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:7a69b6ecf90b9be263edfca0ffa4f40cb8c076f7472559efb09a83a48da92de5_arm64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:92965aba07c6c3ae594fa30f72b47692b9692639f47882d3a29b1fe3938f1325_s390x as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:c00a763b4b037c92378363a29e55c057fd1ae5e7efaded6ca6e53c4be1c13404_amd64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/istio-rhel8-operator@sha256:231e044e7f872d658114881aab776604e583d2b8da0448a2272ffd15c711db3d_ppc64le as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/istio-rhel8-operator@sha256:3c87f98e0b065af6bd93090edaa2187218dbed286f712a56daefad5a2bd124ae_amd64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/istio-rhel8-operator@sha256:bd7006b966f6d367bc1814750c1465f7ffb9e39fc2fb7d3607d11dabc77115d6_s390x as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/istio-rhel8-operator@sha256:cf746daf197865ecb846af2475fcea56c0555c8bdafb7864d4718f1da3d872dc_arm64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/kiali-ossmc-rhel8@sha256:2050b64b6d66ba3c4a068311ab1737219c318ec4f9e4b07cc33fecf47c3b6795_amd64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/kiali-ossmc-rhel8@sha256:276689457eada53dacecf65a92bf64a7535add94c728b165771bc27e3b10009c_s390x as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/kiali-ossmc-rhel8@sha256:29cf0230854ac71bb01095db0b07783bac74d12b4164d263bd66f1d225fb48bd_ppc64le as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/kiali-ossmc-rhel8@sha256:d6ae2eb93558b129b0051980ff73e0e09d41763eb29c2564a28a60281d9f59c7_arm64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/kiali-rhel8-operator@sha256:5c6810907b68548ca4d79b6d07e9b936ce74e4efbd2e39e225793bce1d15e1d9_s390x as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/kiali-rhel8-operator@sha256:7a35294bd4d2a4f9d2fbc3ac1f24e8aef5aa0a84c2780c275348c77df68f5a32_ppc64le as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/kiali-rhel8-operator@sha256:80ad09921b68b246a30bcfebef670cac228e5b8e0a7db63c0462e09a518d68ec_arm64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/kiali-rhel8-operator@sha256:b28f8f238dfa4dc4590fe326ef1c0db17238dda3640a0e9fdf8fb93a69b4e0c3_amd64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:37bb32758dbda228f036d2b0cb3cf7010926334f9ebc82bebf0cac5c397c9bd3_amd64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:4223dcfd7630709f2841b220281120cc6010548d8e59e27cebdf304f16fcf3ac_arm64 as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:acab16ff4de53601dd13971b5165f5ca6ba68345be9a2135469e246d385243cc_s390x as a component of RHOSSM 2.6 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:ce49c56b67a541d00a985c7e7da4a8d36d968f93bafd5d037586476c3583f9d8_ppc64le as a component of RHOSSM 2.6 for RHEL 8
  • +12 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat build of curl uses OpenSSL, which is not included in the affected list of GnuTLS, Schannel, Secure Transport and mbedTLS. Inspect which TLS backend is in use by running: $ curl --version Check the reference for curl handled by the maintainers which may contain more relevant information around this vulnerability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: This flaw can be mitigated by configuring envoy to treat all IPs as external. This is done by setting the internal_address_config range for envoy to `0.0.0.0/32`.

🔗 References (16)