RHSA-2025:1448HighCVSS 8.2

Red Hat Security Advisory: RHOAI 2.17.0 - Red Hat OpenShift AI

Published
February 13, 2025
Last Modified
August 24, 2026

🔗 CVE IDs covered (7)

CVE-2024-45338 →CVE-2024-45339 →CVE-2024-49767 →CVE-2024-52798 →CVE-2024-55565 →CVE-2024-21538 →CVE-2024-45337 →

📋 Description

CVE-2024-21538 — cross-spawn: regular expression denial of service CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2024-45339 — github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog CVE-2024-49767 — werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms CVE-2024-52798 — path-to-regexp: path-to-regexp Unpatched path-to-regexp ReDoS in 0.1.x CVE-2024-55565 — nanoid: nanoid mishandles non-integer values

🎯 Affected products28

  • Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-codeflare-operator-rhel8@sha256:fc6d4c739d6e71fd613aa5ba0821035f0a8e783ea94a411abb82b26a5d79406d_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-dashboard-rhel8@sha256:e19276083d932dad46be57674cadf2757a4eeb5d1e2cc2b4ae650e0c8d2c1b02_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8@sha256:d78353c90bfbdf943547d5f6e3f547ab02f47836ca2cbf3f101977685bf3e34c_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8@sha256:5895e8a111dcd34e6cfec5ce9f84430164b4f6ee43daf8029d0c3b7eeffdd25c_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel8@sha256:913162d37998b5f5503ea9a6acdd32a03fe1588658ed481027c381feaa298542_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel8@sha256:0b105c6231945f7907424520f53df8ae5cfec9e4dd8fe8894928851e06729917_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-kuberay-operator-controller-rhel8@sha256:ba1d528589d4ea5288cdb424a84caf2e2ac394105f3343d8cbff299e2f1fb012_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-kueue-controller-rhel8@sha256:849977d802846fceb0b642c28db3611a88163b6025de36695205d81162935497_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-ml-pipelines-api-server-v2-rhel8@sha256:85b991f09d439ca1e1df6b490097f587a76a2aaf94cb98f360e513f0d153483a_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-ml-pipelines-driver-rhel8@sha256:8c3b9c8d8303f45766dea82194cf0d886eeb74bf9055c5aae06c8e78f8d28b04_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel8@sha256:83c2d8f4f66835bd22cfd29f4ae9b57bfacf16393b5080fbbe3057cab90dfdda_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8@sha256:b94552aa082251c6c7b85d49cd3444a12149b8825473619517fa3edbd1748195_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8@sha256:5979ff12a1b4b96b307ffc601388c195a5ce49bf53c85b7a9e7da20f6266ff8d_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel8@sha256:f9a98109664adec37649f616f63e86605df2feb6fb9178b37ddeba59f6460930_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-mm-rest-proxy-rhel8@sha256:c2995df85c0023ebc43e9dc30a258323353387450af99295fd67b57fb8afc36b_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-model-controller-rhel8@sha256:f581ada86bbf09e794c9ae100197a7dda618ca1efc344281839801609123902f_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-model-registry-operator-rhel8@sha256:47653dc36a82d1b00f10d03df92aa836be8111c381cdb9caabd3a68829f6d683_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-model-registry-rhel8@sha256:713025cc0357b2052bec976eb74f2e0ec14c1ea4426c1f1eb78a6331973db7a7_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:58fc4ea5fcabd64c061a4f30259b354ffbcbb8c16ffc442f47404ddd49ffd3c9_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-modelmesh-runtime-adapter-rhel8@sha256:78e18816a15b2d744a76710523a574f483606646d5e661b58a1d8562dc85526f_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-modelmesh-serving-controller-rhel8@sha256:d846107b3580c8ec623bf7cb131236990d20df91ee5c4b2c53474d18e0e112a1_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-notebook-controller-rhel8@sha256:58516cc6ece1c6bfb6c426006b2820333c8be181f7e16471b24f52cb024df6b3_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-operator-bundle@sha256:8894db3352d2c8e666bbd0b93ae36474f6d2dcf1e59c24328de8a95667a45bb0_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-rhel8-operator@sha256:73330b67b6b104e67468463f2de1b029530793fc2df550c70851e6a3575e6307_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-training-operator-rhel8@sha256:3e6c0ff6036b1feedfae2ddbc287e8dee1ee7f8e69ca7e0b911f77c929c50e53_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel8@sha256:cdf0176ce6a2425ed485e188ae25c83b1accbceed515c426c6101a014b43d837_amd64 as a component of Red Hat OpenShift AI 2.17
  • registry.redhat.io/rhoai/odh-trustyai-service-rhel8@sha256:9f5c7f682c534d3d07daceaef8c49c7d03d489f160b0adccdb296c5b9f67b748_amd64 as a component of Red Hat OpenShift AI 2.17

✅ Remediation

For Red Hat OpenShift AI 2.17.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: The Request.max_content_length setting and resource limits provided by deployment software and platforms are available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application. Workaround: Avoid using two parameters within a single path segment when the separator is not, for example, /:a-:b. Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.

🔗 References (10)