RHSA-2024:8415HighCVSS 8.0

Red Hat Security Advisory: OpenShift Container Platform 4.16.19 bug fix and security update

Published
October 30, 2024
Last Modified
August 19, 2026

🔗 CVE IDs covered (3)

CVE-2024-6508 →CVE-2024-24786 →CVE-2024-47211 →

📋 Description

CVE-2024-6508 — openshift-console: OAuth2 insufficient state parameter entropy CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-47211 — openstack-ironic: Lack of checksum validation on images

🎯 Affected products69

  • Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:533a8d232a4916ed2b168970a34ee3a96e08289bc6d53185e163c20df3517e37_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:59216c26926c3a08361390e24d1424587c18e46b9ed8f175fb046b57b2d66ef9_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:5a138857a49dd4d1fc384646ad5d853d3edc9367dd3d6751ce8ec7d9f850370c_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:74cf380f5a610383296e4b2e3f72c84ff608d175adee452b91f5f4840d9937dd_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-cloud-controller-manager-rhel9-operator@sha256:2196682fb921b669e1f5042cafde168dbe266d109fe44017c3b6b9e29298aaa9_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-cloud-controller-manager-rhel9-operator@sha256:6e933ec4c9b321c2045af6e8c4317cea926c71cbcfe8fc8ef496cbf634bd5ada_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-cloud-controller-manager-rhel9-operator@sha256:74138480f5d099d2cf2708b3bafff8b3ba5f43f18a466935bdbba7468ae1718f_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-cloud-controller-manager-rhel9-operator@sha256:df8587254b7aad81aebc6f5a09ca3caacf6f1e3b0fe7fe424fbcd99c6cec3a23_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-image-registry-rhel9-operator@sha256:24c3031c7a1192ff39f213b80fc266cae66923744d8797da868cb83a86a8d234_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-image-registry-rhel9-operator@sha256:c54f5a3ab8452b1991d9c1e4adc724694ea85d3d5cbb315f09dd48ae191f43c9_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-image-registry-rhel9-operator@sha256:c70a662aab6520e4c8f3079a20fe96c4c100df88d2f8828ada67d2765a8b6a2e_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-image-registry-rhel9-operator@sha256:e4410a6066eb5dbeb541d8e4486b8a452476d5fa103399e18a84089233fd2672_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-network-rhel9-operator@sha256:1d37dcc2c2483dd4188c514e2f86ebc9030c833af892b9242689b88497ed6e1b_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-network-rhel9-operator@sha256:5c32845c69536d69c614f6777726176f57d18571bde429b643494c93b5fbcf5c_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-network-rhel9-operator@sha256:90afa0fc02f587e9d82984f8ec89c0d23f886ba12f394aa74d91a9032635848d_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-network-rhel9-operator@sha256:9cdd3a92a376fd185c57453167ea93406f301cb4dfd93ead0f541b804f73dea0_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-storage-rhel9-operator@sha256:757beba938316e01139a479320136acce9d076346e2d6ef9f9061a904de36070_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-storage-rhel9-operator@sha256:9f1f514f48b797edbe600a0eb791905511e6058d262047e5e715b29bd8103415_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-storage-rhel9-operator@sha256:c0263f9ba5047d5ffc4714da655df5868361815513bca8595debd523ba3e8d25_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-cluster-storage-rhel9-operator@sha256:e40a8e44fb88cb09951d683f533c4f2c4b185a58f9313b945bc373bf5888d67d_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-console-rhel9@sha256:2203916159d6d1728676deebe075e9b74fc15cc1d51da84afa92cc7318db4d42_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-console-rhel9@sha256:267d5526d0255d9336a73e91332d1b14eb7638af7e7ab6cec5564ed0e31867c5_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-console-rhel9@sha256:377f6ff1d3e5b2e24b4bc2fadabadbf2a71c5e212ad3d6ee25f07ef17fb3ae7d_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-console-rhel9@sha256:ce46b89f34dc916f506838a76faf1234d9dbcf463079f093bc36d20f50a93ffa_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-hypershift-rhel9@sha256:2233ce88252ee41e81b0c8d7d61296789f9b822f6b17503c6c8f0feb7bdb19a5_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-hypershift-rhel9@sha256:2c9203183bd6e519120f0419dc0ac3a810f04f6f94e11cf66371126930fa6813_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-hypershift-rhel9@sha256:dcd1abae422f5e3d427a81566cc517aa2e17905668774cca30a954669bbcd17c_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-hypershift-rhel9@sha256:ef304553f3ace708023d8e80d3cb18e4a4a56f33496f0871fd8637648a5b1ee3_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-ibmcloud-machine-controllers-rhel9@sha256:0fd5f05dd8abd53c3545079772e9852746558a05057bd31b7774295b90c5394b_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • +39 more not shown

✅ Remediation

For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:91167e05309698940a16cfb80096772100fdd7c612bee4b84084b1deb26d562a (For s390x architecture) The image digest is sha256:bf0f76c2f460aceb7bff00bb52bf7741da2bd4cd2b6090f2d1fddf145b1d4ce1 (For ppc64le architecture) The image digest is sha256:cc7bac5a4058b58b4e715967f0b90016b581485ab85c55f941a3cebf85da9f9c (For aarch64 architecture) The image digest is sha256:fc8b5ba9f694bdee0fb5329c4f8f74ce5736a017d44029eb0c561566171feab5 All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (16)