Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
EUVDB-ID: #VU97216
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-34156
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to encoding/gob does not properly control consumption of internal resources when calling Decoder.Decode. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Note, this vulnerability is related to #VU66068 (CVE-2024-34156).
Install updates from vendor's website.
openshift4-aws-iso (Red Hat package): before 4.16.0-202410172045.p0.gd2acdd5.assembly.stream.el8
containernetworking-plugins (Red Hat package): before 1.4.0-5.rhaos4.16.el8
butane (Red Hat package): before 0.21.0-4.rhaos4.16.el8
skopeo (Red Hat package): before 1.14.5-3.rhaos4.16.el9
runc (Red Hat package): before 1.1.14-3.rhaos4.16.el9
podman (Red Hat package): before 4.9.4-12.rhaos4.16.el9
ose-gcp-gcr-image-credential-provider (Red Hat package): before 4.16.0-202410172045.p0.g26b43df.assembly.stream.el9
ose-azure-acr-image-credential-provider (Red Hat package): before 4.16.0-202410172045.p0.g0e95532.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package): before 4.16.0-202410172045.p0.ga53e9de.assembly.stream.el9
openshift-clients (Red Hat package): before 4.16.0-202410172045.p0.gcf533b5.assembly.stream.el9
openshift-ansible (Red Hat package): before 4.16.0-202410172045.p0.g06f35b9.assembly.stream.el9
openshift (Red Hat package): before 4.16.0-202410172045.p0.g632b078.assembly.stream.el9
ignition (Red Hat package): before 2.18.0-5.rhaos4.16.el9
cri-tools (Red Hat package): before 1.29.0-6.el9
cri-o (Red Hat package): before 1.29.9-5.rhaos4.16.git34690b9.el9
conmon (Red Hat package): before 2.1.10-5.rhaos4.16.el9
buildah (Red Hat package): before 1.33.7-4.rhaos4.16.el9
Red Hat OpenShift Container Platform: before 4.16.18
CPE2.3http://access.redhat.com/errata/RHSA-2024:8263
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU98141
Risk: Low
CVSSv3.1: 2.4 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-9341
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container.
MitigationInstall updates from vendor's website.
openshift4-aws-iso (Red Hat package): before 4.16.0-202410172045.p0.gd2acdd5.assembly.stream.el8
containernetworking-plugins (Red Hat package): before 1.4.0-5.rhaos4.16.el8
butane (Red Hat package): before 0.21.0-4.rhaos4.16.el8
skopeo (Red Hat package): before 1.14.5-3.rhaos4.16.el9
runc (Red Hat package): before 1.1.14-3.rhaos4.16.el9
podman (Red Hat package): before 4.9.4-12.rhaos4.16.el9
ose-gcp-gcr-image-credential-provider (Red Hat package): before 4.16.0-202410172045.p0.g26b43df.assembly.stream.el9
ose-azure-acr-image-credential-provider (Red Hat package): before 4.16.0-202410172045.p0.g0e95532.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package): before 4.16.0-202410172045.p0.ga53e9de.assembly.stream.el9
openshift-clients (Red Hat package): before 4.16.0-202410172045.p0.gcf533b5.assembly.stream.el9
openshift-ansible (Red Hat package): before 4.16.0-202410172045.p0.g06f35b9.assembly.stream.el9
openshift (Red Hat package): before 4.16.0-202410172045.p0.g632b078.assembly.stream.el9
ignition (Red Hat package): before 2.18.0-5.rhaos4.16.el9
cri-tools (Red Hat package): before 1.29.0-6.el9
cri-o (Red Hat package): before 1.29.9-5.rhaos4.16.git34690b9.el9
conmon (Red Hat package): before 2.1.10-5.rhaos4.16.el9
buildah (Red Hat package): before 1.33.7-4.rhaos4.16.el9
Red Hat OpenShift Container Platform: before 4.16.18
CPE2.3http://access.redhat.com/errata/RHSA-2024:8263
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU97215
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-34155
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to go/parser does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
openshift4-aws-iso (Red Hat package): before 4.16.0-202410172045.p0.gd2acdd5.assembly.stream.el8
containernetworking-plugins (Red Hat package): before 1.4.0-5.rhaos4.16.el8
butane (Red Hat package): before 0.21.0-4.rhaos4.16.el8
skopeo (Red Hat package): before 1.14.5-3.rhaos4.16.el9
runc (Red Hat package): before 1.1.14-3.rhaos4.16.el9
podman (Red Hat package): before 4.9.4-12.rhaos4.16.el9
ose-gcp-gcr-image-credential-provider (Red Hat package): before 4.16.0-202410172045.p0.g26b43df.assembly.stream.el9
ose-azure-acr-image-credential-provider (Red Hat package): before 4.16.0-202410172045.p0.g0e95532.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package): before 4.16.0-202410172045.p0.ga53e9de.assembly.stream.el9
openshift-clients (Red Hat package): before 4.16.0-202410172045.p0.gcf533b5.assembly.stream.el9
openshift-ansible (Red Hat package): before 4.16.0-202410172045.p0.g06f35b9.assembly.stream.el9
openshift (Red Hat package): before 4.16.0-202410172045.p0.g632b078.assembly.stream.el9
ignition (Red Hat package): before 2.18.0-5.rhaos4.16.el9
cri-tools (Red Hat package): before 1.29.0-6.el9
cri-o (Red Hat package): before 1.29.9-5.rhaos4.16.git34690b9.el9
conmon (Red Hat package): before 2.1.10-5.rhaos4.16.el9
buildah (Red Hat package): before 1.33.7-4.rhaos4.16.el9
Red Hat OpenShift Container Platform: before 4.16.18
CPE2.3http://access.redhat.com/errata/RHSA-2024:8263
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU97217
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-34158
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to go/build/constraint does not properly control consumption of internal resources when calling Parse on a "// +build" build tag line with deeply nested expressions. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
openshift4-aws-iso (Red Hat package): before 4.16.0-202410172045.p0.gd2acdd5.assembly.stream.el8
containernetworking-plugins (Red Hat package): before 1.4.0-5.rhaos4.16.el8
butane (Red Hat package): before 0.21.0-4.rhaos4.16.el8
skopeo (Red Hat package): before 1.14.5-3.rhaos4.16.el9
runc (Red Hat package): before 1.1.14-3.rhaos4.16.el9
podman (Red Hat package): before 4.9.4-12.rhaos4.16.el9
ose-gcp-gcr-image-credential-provider (Red Hat package): before 4.16.0-202410172045.p0.g26b43df.assembly.stream.el9
ose-azure-acr-image-credential-provider (Red Hat package): before 4.16.0-202410172045.p0.g0e95532.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package): before 4.16.0-202410172045.p0.ga53e9de.assembly.stream.el9
openshift-clients (Red Hat package): before 4.16.0-202410172045.p0.gcf533b5.assembly.stream.el9
openshift-ansible (Red Hat package): before 4.16.0-202410172045.p0.g06f35b9.assembly.stream.el9
openshift (Red Hat package): before 4.16.0-202410172045.p0.g632b078.assembly.stream.el9
ignition (Red Hat package): before 2.18.0-5.rhaos4.16.el9
cri-tools (Red Hat package): before 1.29.0-6.el9
cri-o (Red Hat package): before 1.29.9-5.rhaos4.16.git34690b9.el9
conmon (Red Hat package): before 2.1.10-5.rhaos4.16.el9
buildah (Red Hat package): before 1.33.7-4.rhaos4.16.el9
Red Hat OpenShift Container Platform: before 4.16.18
CPE2.3http://access.redhat.com/errata/RHSA-2024:8263
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.