RHSA-2024:8676HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.0 Security, Enhancement, & Bug Fix Update

Published
October 30, 2024
Last Modified
August 25, 2026

🔗 CVE IDs covered (12)

CVE-2023-26136 →CVE-2024-24786 →CVE-2024-24789 →CVE-2024-28176 →CVE-2024-41818 →CVE-2024-43788 →CVE-2024-43796 →CVE-2024-43799 →CVE-2023-26364 →CVE-2024-43800 →CVE-2024-45296 →CVE-2024-45590 →

📋 Description

CVE-2023-26136 — tough-cookie: prototype pollution in cookie memstore CVE-2023-26364 — css-tools: Improper Input Validation causes Denial of Service via Regular Expression CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-24789 — golang: archive/zip: Incorrect handling of certain ZIP files CVE-2024-28176 — jose: resource exhaustion CVE-2024-41818 — fast-xml-parser: ReDOS at currency parsing in currency.js CVE-2024-43788 — webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule CVE-2024-43796 — express: Improper Input Handling in Express Redirects CVE-2024-43799 — send: Code Execution Vulnerability in Send Library CVE-2024-43800 — serve-static: Improper Sanitization in serve-static CVE-2024-45296 — path-to-regexp: Backtracking regular expressions cause ReDoS CVE-2024-45590 — body-parser: Denial of Service Vulnerability in body-parser

🎯 Affected products106

  • RHODF 4.17 for RHEL 9
  • odf4/cephcsi-operator-bundle@sha256:2b9e511b21d4fefe8450f014962f2450db3e64af07f5e6e4bbfdaafafdfdc1f4_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-operator-bundle@sha256:9a822fddffde8f67711c5025a89e003341011e0b8145cfd5b840849cabbe68a0_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-operator-bundle@sha256:e35426de9ea6419f4981d8c6861867fc3eadcde4e41757b9a8f1ed4f2fa00dc9_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9-operator@sha256:78656a47235af49c9a7bc75d9729987edf39a77077a3f478f5b46658df18878a_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9-operator@sha256:92544e943e160d8fce1a9710a9d67ca4ccb795ff846edf7717d1e52835899202_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9-operator@sha256:9615793800efca765c5ae588e0547e4e18bdfe264c8a92303fbbc39276c74580_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9-operator@sha256:d6e30344ec1d541b6791b0e58cb48f4f3f492069ff8392005e8d1f16350c80e2_arm64 as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:7bc24afafec3a0896c887d7eeeca47eb6f0cb12e35c62aa212ce55210cb1512d_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:93b238c24a3623bd635e162caa9a30ad7158db25eb83b545e9b365db0f769161_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:fb6507b95b53b19d90b82c3ac2a3b0264ebbdb9d4a8ceff3006e8a446a1cef49_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:22b568f083c7563ffbb8d23807837a0f78cedeb156cffe9110906f3b6e0c70fb_arm64 as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:50f66564131a5b2b695582956c80515d7eea64d1c009479665937c97a76e2348_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:a27c28ecf714cc248323a35eb58daec2aa611a318f0e61eb0defe0eaa80eb2f4_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:bee14d945af0620ad1666e67be750324a1814cbf573256c1c88521e18f9877f7_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:71b79ea2f0356740a0e53e89a0422f8da608dd43337dd07dfcbadc9f9d8a8884_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:729fdaad48dfca53af4b3bf9bbf3cbf9dd25d5c50ddcbac03d0e8738aeb997cc_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:ed0d44fd0215cd299b4929617fa1f05ea31c6ee3cc078fbf6cc884e02a59beee_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:1d189e8c4dfcc998d5887e1c5f06e874fa0beed29bc8f87f279299d58124a505_arm64 as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:5f92812a17a6637280387a3033865d8bd13ee8d6506f8e17489cefb79c53f58e_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:7eba9da5ba5071b411bc99d33eee04e3f4530516ad984524920de542629e9b55_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:f8c6007e32c54ffe0597952ae6eb1d38435188d605f3995ec785dff43da4257d_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:824823d527bdbbdd2abb773e054c12b41243e15467ada76689af4fdd6fae894a_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:9521eae22f7669dea4b31841d7cfe11e5d92155b11785afb2977cea9c5d917dc_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:a94961fd2c5aea06922c9c365c3a6296abf073e09a520f190a45f687cabc7b1d_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:26503c487a93ad520e1953ccad9200be808bc93648db90eaba3a73a340483541_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:78f3e869e50bd0e69d8e6efc6e6de357aadcc06ac3659d6ec7a053cda11be88b_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:fb473ae152002d124ff662e94ca9bf68f8f6a4c61c40d4f2929a55ef1c25cd20_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:0bb022ca33965fb0f9de7df36f15377a33c90d873050dcbd763370ac1f06295a_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:1070f8191e3ead7781876ed4d84ac5c5eeb54a1fa4d2c40701ebf393d345111c_ppc64le as a component of RHODF 4.17 for RHEL 9
  • +76 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is yet available for this vulnerability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (132)