RHSA-2024:9485HighCVSS 7.5

Red Hat Security Advisory: Control plane Operators for RHOSO 18.0.3 (Feature Release 1) security update

Published
November 13, 2024
Last Modified
August 20, 2026

🔗 CVE IDs covered (8)

CVE-2024-24784 →CVE-2024-24785 →CVE-2024-24788 →CVE-2024-34155 →CVE-2024-34156 →CVE-2023-45289 →CVE-2023-45290 →CVE-2024-24783 →

📋 Description

CVE-2023-45289 — golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect CVE-2023-45290 — golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm CVE-2024-24783 — golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm CVE-2024-24784 — golang: net/mail: comments in display names are incorrectly handled CVE-2024-24785 — golang: html/template: errors returned from MarshalJSON methods may break template escaping CVE-2024-24788 — golang: net: malformed DNS message can cause infinite loop CVE-2024-34155 — go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion CVE-2024-34156 — encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

🎯 Affected products26

  • 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/barbican-rhel9-operator@sha256:9d4c302bf3ef3861b54fc401d1742e91b089e9172c28fcf7d450dac4c50f03ea_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/cinder-rhel9-operator@sha256:5b0a67c7eb1eeda740c1d7659eea8ab51a21427e1ba2ff1714860bc7f01a3ca6_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/designate-rhel9-operator@sha256:a5646a3a3d6f7584538ecddeac5537e26ae6c0f60b36df7ebae1bd527cc982c7_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/glance-rhel9-operator@sha256:a1c8bcc3bc80b8787bed607276084c23bc7891ddb91eba6f145779a8fe481834_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/heat-rhel9-operator@sha256:ea965c08c2c7d31410ed80b8eb808933cc511783f8c69b0d1bd8a17ee9abf19d_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/horizon-rhel9-operator@sha256:17246bbe4f31daffc1614ac6a3d5d90a552b2cdd68d757bd48be6c57d31f6c2e_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/infra-rhel9-operator@sha256:5c873e80bc6a33ac0244e75ef93582e22f211125ed50fd06b4537cc8db15e37e_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/ironic-rhel9-operator@sha256:030589a0e86a20a306c3e9118c3f29ee95d409fc88a1173f174c11556c6ca58c_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/keystone-rhel9-operator@sha256:6d2d87f44b7c0b3b5aff6bc2ad112d4bcd3e5f2a2a157f449842cc9340789392_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/manila-rhel9-operator@sha256:15356683398fada9c162ccc37f150477f39a1c53f55033d07c712ad6aa317e36_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/mariadb-rhel9-operator@sha256:98bcc0d3c4b05d160a615165426c13bb2318597fa126c2fe9a38688d81fd4ea1_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/neutron-rhel9-operator@sha256:850c2f1377fa0a5a0143ed226abccbec78ed03d86adcdc1e9daaa2dd45614d49_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/nova-rhel9-operator@sha256:641657e9340a21d5e82e81407b2b3719df6eed8cd8334171aaa338dde86d6d52_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/octavia-rhel9-operator@sha256:605b6c299ab3bd243638a7896c2f5105fcfddbe92d1d6975ad3819f449c00709_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/openstack-baremetal-agent-rhel9@sha256:f08212d197b81bbcd1e44ffb5e20d2b7327b3b438b103e37065783f9027c020c_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/openstack-baremetal-rhel9-operator@sha256:0960068ccad1929734b174c67a64e06d7afc1851123c117dc942d2873046f808_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/openstack-must-gather-rhel9@sha256:586ab3bab72c0dd76418c6e4fbf49577c289430212567aab495cd7231d52e4fc_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/openstack-rhel9-operator@sha256:7d7de1bbcd1154bb6aa9c1d0e94c1413aad4714b3cbe8d6d2512bca238af3292_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/ovn-rhel9-operator@sha256:cca32c23677bf4ad3405d7151ced32b4963860edd50981b236b8ef636567e982_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/placement-rhel9-operator@sha256:44c1ef6eacfa049e4846dabd182648ccad01df7f5019ac7ea9d98bc8b0e2d95f_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/rabbitmq-cluster-rhel9-operator@sha256:e9f6e20f5e7a11cea3533cebc6834ce36d20007ad3fc866c373e410c66c8195d_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/sg-core-rhel9@sha256:e40fac6ed64076c41c6056df02153011ea9ac575ca018aa1c9c3b8093426f6d4_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/swift-rhel9-operator@sha256:59483bd45a23f40462c37064ec6dc334b8366f6266aa959825d2a8ed7075ff40_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/telemetry-rhel9-operator@sha256:66fefdca3acda5f33d8eefe32abd3a2c1e3665e5ae9456683dca604524001695_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED
  • rhoso-operators/test-rhel9-operator@sha256:e248484aaea76516e4c504439608f3ccfd5236756521156780ada8a14bf25b98_amd64 as a component of 9Base-RHOSO-1.0-PODIFIED

✅ Remediation

RHOSO OpenStack Podified Control Plane Operators Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (61)