RHSA-2024:9620HighCVSS 8.2

Red Hat Security Advisory: OpenShift Container Platform 4.14.41 bug fix and security update

Published
November 20, 2024
Last Modified
August 15, 2026

🔗 CVE IDs covered (4)

CVE-2024-47875 →CVE-2024-48910 →CVE-2024-6508 →CVE-2024-7409 →

📋 Description

CVE-2024-6508 — openshift-console: OAuth2 insufficient state parameter entropy CVE-2024-7409 — QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure CVE-2024-47875 — dompurify: nesting-based mutation XSS vulnerability CVE-2024-48910 — dompurify: DOMPurify vulnerable to tampering by prototype pollution

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:4a1a849ea40d38ce87bad3c3852c16fddce550bff1fd6a7589b74eef0c4cbc81_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:54e2239813520eea167c9a6b973c9f5c0fcad2cc59f8e0148af25ec9b14f6ecc_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:9b592fb9db68065510a636f18b60cb75880cca8395968fc05f2ad241942fde67_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:df5267606dc4a04ef36dd1941eb66703f21e2ee3fff16a597fb9fefe50b96cfc_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:3b42ac72cd7407cd9c05d27b1daa91c3fbd2272275beaae921b65227a23d0ea6_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:3ea4f547d09661792698c845408d1f6facfa35bbb202cffa5c63b6f62a912b19_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:632361566980091343a3fcf000999a722c6ac491075a906d944ce018e100575b_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:e06eb3993fb60266cc143ae77c9176b5aa01a0fc3d9904d80bbc45bde97caa94_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:425e05258244e3961e8d520bca044d7d2eb9becfe2875eb33c1d19069548264e_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:6f08c16d6b9d3f9553b29fec72e8d522161391351951368ec31466b4d58e998d_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:91b0efd74014dada6e314ecbf4029ec1790e4d21c93a12918410a85610eb5fca_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:bb4de2de6269881ef3264fac563d12e6d534a206e862721207ed72fe023a61f7_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:141dd48630d66e116b97f300274de15cb0edf86c04ff249e608d35c2af4462b1_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:23057316d33429dd1363459f1ece50925706347903a9f4f2044822b8c46c7dd4_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:52d559fef4f0be6713b83be66d1d2cc18c44fa5e794f4b26e7deed8333b6676d_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:c773be4cec4b1f65c548b000a05bafe34c9fe6f39d98af0e9e135a8a06c73f14_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:56b9a18cc60005d433a512dc52b348738ddedf79a19cdd681386dd7b49bad2a1_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:64048ffeda8c1f1f279f12e6ac90e44e71b4ad36c157ac9251766cabf4d23784_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:64530c7da8eee94c90a7c28515f965142e2bbc558b1505acfd4d4fd3e0a9d705_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:a32fffd5ad6130d8e098646c59004926c045b23046ed9c540a477fa4a7d3c7ba_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:08bfc089e6fa0ad39ee3be9966b4d9384e46b254d0d1eb78d9af7d94980aedf1_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:2a945dd88f891b39eec266baaceb531de08ca197b9c1e9c658dc7ac69d36aa66_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:9f55bb571ca6e28700dcdad7f010c385d18821188fceecfbcdd9d8e1c2d6ea53_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:ef1fabf95b17eedc083783d9bc66bf12fc3082f89a36e13d18dffdcdf66179da_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:34c904aba6d02060755465fc36fb54b3e3b97eca92042a459c7a5202745f357c_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:5ec55610f4f63b7e4b220e12881b4394f30d3074249d95111fe3a8f726365a90_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:d57e27c1dfce4af3f5b7f4c7c6152d12635933001adb7818475bdcd460466714_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:da7a28ce8d73dec535660cffd7836c43a193b1aca0af0258c2782c4453cc9125_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:253da56bd5da0d5ff45d284889465d522cefa735fb9bc329bf50e52935c45b4d_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:f4c6252655cea21b790ab6bd8d88da9a657d787a365cedf79bcab8371eb11290 (For s390x architecture) The image digest is sha256:b7a9b6bebff381cd86dd38747a43045fba0f2ff1903c87ac551d7cada723ebcb (For ppc64le architecture) The image digest is sha256:6823347a606e8ea4e08708bbc8ca3fefa60f3b2659d86478885b6f7405baf14b (For aarch64 architecture) The image digest is sha256:870cc14058a63d173f50f7a2f8d0140e48e6f283bc8521584f1e73002cc17d5f All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (21)