RHSA-2024:8704MediumCVSS 5.9

Red Hat Security Advisory: Kube Descheduler Operator for Red Hat OpenShift 5.0.2 for RHEL 9

Published
December 2, 2024
Last Modified
August 22, 2026

🔗 CVE IDs covered (3)

CVE-2024-24786 →CVE-2024-34155 →CVE-2024-34158 →

📋 Description

CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-34155 — go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion CVE-2024-34158 — go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion

🎯 Affected products13

  • KDO 5.0 for RHEL 9
  • kube-descheduler-operator/descheduler-rhel9@sha256:76141323ebf07fe673b4747e4364069eced49b02f6854a02e3029b2cd5da6ec7_amd64 as a component of KDO 5.0 for RHEL 9
  • kube-descheduler-operator/descheduler-rhel9@sha256:8e9112c13e3eda54533a29da7bc20ee4b163ba92fb640b7d8c4faabe49ca73af_ppc64le as a component of KDO 5.0 for RHEL 9
  • kube-descheduler-operator/descheduler-rhel9@sha256:adbf99466aa02108bc52070d9522248bbc8eba7114f7f4442abe3ec4e9556068_arm64 as a component of KDO 5.0 for RHEL 9
  • kube-descheduler-operator/descheduler-rhel9@sha256:bf361a84cc4ac936aeecac55ee9b26b796bef0810ab1c6c9b03f2f2ace323d40_s390x as a component of KDO 5.0 for RHEL 9
  • kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:02771552e6b42aca77dfd8bcea14399126fc2b702c9e78a53d950a1622596690_arm64 as a component of KDO 5.0 for RHEL 9
  • kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:0b0c9d8a65c5b005f700c76b8e4076ec8f3472dcabe6eebf9fa9bee4afaf06a7_ppc64le as a component of KDO 5.0 for RHEL 9
  • kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:72c2aeb630281a636cad334fbbf0e67b70afba26c61a1b25a2b93277765e5ac7_amd64 as a component of KDO 5.0 for RHEL 9
  • kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:fc575edc883ca250d9b218a6f29acc9f233b574128888307b5f588bc8532b87a_s390x as a component of KDO 5.0 for RHEL 9
  • kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:673202819c37454fa57e836a7564b4d62260ebbd613e529c6849e6f99da36fa9_s390x as a component of KDO 5.0 for RHEL 9
  • kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:a985a362a4b7007f732b3233ae480e763a80cc098c29a69ccc52f2c110f4a7de_arm64 as a component of KDO 5.0 for RHEL 9
  • kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:c7ab759f5583f6eea7b9f9af0c5d2235cfad496e9894ae433f33d9706eee13bc_ppc64le as a component of KDO 5.0 for RHEL 9
  • kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:dd4aae772fb0cab0eb0cbac1f00dde6437663edcdc761009b04505cee674452d_amd64 as a component of KDO 5.0 for RHEL 9

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (6)