RHSA-2024:7939HighCVSS 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.13.52 security update

Published
October 16, 2024
Last Modified
October 15, 2026

🔗 CVE IDs covered (1)

CVE-2024-2961 →

📋 Description

CVE-2024-2961 — glibc: Out of bounds write in iconv may lead to remote code execution

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:309ba3b9936db412ef9e2119a997410932856b98d9d0d0bde86b7f29640bfb0c_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:326b7cc4631dd49fe93906966ff1d1d5fdd1084f87ce0b9b68270192758c5a2e_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:8eaed5ff963b968a072b37a8cc3e9d44f1f7d12c0ffbf45fef452424def24603_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:dd9f96346c253e0b28470a0daf1d49aa94d527365599a378c698b6f471892db9_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:1124ea4709029a464389a2840face0dba10587ae678f5a9471896e069cdcb1bb_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:406fa5f5ab351660020050dbc03f7db3607e6c378b41e1b6c1573041c534af97_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:9e2d95a8551185659eee1bd007dc60fcdf7acd57653827bc83ceacf5ef93e8a2_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:d339ef7924a312739bec886dbde488a3470e18511739969b97d6d27cdb3553d2_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:0ea031a25f57a7fba4fd0ec27b1b646b8a674fccf6d7ce4eb3d10e99f41bb8c3_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:868470709c5db4d1c04b8a2129b568234a9497cde77b3207eb5ae60825b42f4a_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:d6f51b6a00726d4c4843283f6961cf381f8e303206aa6d8192a3fb6873090190_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:e2a3e6939d407970346c23b07dadabedf34fd898ac9632b121a3c6c6c861f23d_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:2de29df4b4c08c708fafd23325f5aa89f95938be16f9d18137078bccb46c8fff_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:3c77305dde78e327788856814f8ab3aa13dc5a2bfc3e3e75cd5a034b4571b139_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:526abb0c0cafe6b5d5de21bb6dad5e0a8c793ccfcfef7d43b04eeeed4502ac19_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:7edecc66cc0be6782f303bd9d42da2f4e9ce8e23e067e3dc72306e8f70248788_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:07a8f513a9492ef138b0d2ace0588067346f43e729ff1c66f96d25ff30370be3_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:5aced8988e9d0b9bdabb00f56b458fb0169b06b550b3af29a57bfb25f0d0d107_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:83b2924bb6392be7de84eaf9b07cab99c0a06d32e80f53ac81250b1e6ed5c6fc_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:db14b76ce35d17be20d72172b12e39765580f9dee068142b9a258ad6a3f04c9d_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/oc-mirror-plugin-rhel8@sha256:8a8e40b71477292e25dc09b2f6f7a73c674ddf148ffc5249a0463aa26c04b10a_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:258379fdf3e5003d0830ab8e01bf6e3040709eb9ce96d9f1d035efdb3d7d221d_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:9139ac2eac893f9b206e6be9da8003a0a158d8281be4a9124e58d2173f1bae48_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:c9a2959ee0557838629cca9947c3103d1ab46b43482a0e44eaa05e592d5f3a60_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:f24ee24f90786079e6f7d510c3d62acc32bf0d80201d695e9620038cb3176c57_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:462524b2c50f15d33f331d5e0e462fb0fbbb587a1f5096cae422eb50bd603808_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:7eb5e7bf9aef4937c99c24409a997f3c5659365770d9d2d851bf7d4e240a9768_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:d60338cb3f1c8cdb51758a110d37cc8175087036827e8716f5455fad4e9d0ca3_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:ebc8578266f7863b4c200fd4e191b346c127c75dd245e6d92a27e59cc52ce01f_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:8bc5879bae06759c0984ed7d93994c005494c133fdb48bb9259fb08529b10c32 (For s390x architecture) The image digest is sha256:3d2467f8a103a40e35da4a3da2e9af8b21ff93daa38401740f9cffc82011972d (For ppc64le architecture) The image digest is sha256:1ba6a85286689727f3940fed03db7d3586a769e63e263448459c685106dadc08 (For aarch64 architecture) The image digest is sha256:cb477dc87a1326f0378f0327c4b841c421feede7b4edd7c44f5434608f3e2bf1 All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html Workaround: This issue can be mitigated by removing the ISO-2022-CN-EXT from glibc-gconv-extra's modules configuration. This can be done by: 1) Verify if the module is loaded by running: ~~~ $ iconv -l | grep -E 'CN-?EXT' ISO-2022-CN-EXT// ISO2022CNEXT// ~~~ If the grep output looks like the above, ISO-2022-CN-EXT module is enabled. 2) Disabled the module by editing the file located at /usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf and comment the following lines. For RHEL 7 the file that needs to be edited is /usr/lib64/gconv/gconv-modules. This step requires to be executed by a privileged user: ~~~ # from to module cost alias ISO2022CNEXT// ISO-2022-CN-EXT// module ISO-2022-CN-EXT// INTERNAL ISO-2022-CN-EXT 1 module INTERNAL ISO-2022-CN-EXT// ISO-2022-CN-EXT 1 ~~~ For commenting those lines just add the '#' character at the beginning of mentioned lines: ~~~ # from to module cost #alias ISO2022CNEXT// ISO-2022-CN-EXT// #module ISO-2022-CN-EXT// INTERNAL ISO-2022-CN-EXT 1 #module INTERNAL ISO-2022-CN-EXT// ISO-2022-CN-EXT 1 ~~~ 3) Update the iconv cache by running: ~~~ sudo iconvconfig ~~~ 4) Check if the module was disabled by running the first step again. This time ISO-2022-CN-EXT should not appear in the output. Please notice that disabling the mentioned gconv module may lead applications relying in the affected module to fail in converting characters and should be used as a temporary mitigation before being able to fully update the affected package.

🔗 References (8)