Red Hat Security Advisory

RHSA-2024:1574

OpenShift Container Platform 4.12.54 packages and security update

Released 2024-04-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.12 buildah-1:1.23.4-5.2.rhaos4.12.el8, buildah-1:1.23.4-5.2.rhaos4.12.el9, buildah-tests-1:1.23.4-5.2.rhaos4.12.el8 +35

Fixes 3 records

TI-2024-16303 CVE-2024-24786 · GHSA-8r3f-844c-mc37

Infinite loop in JSON unmarshaling in google.golang.org/protobuf

MEDIUM 41

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01262 Published 2024-03-05 Partial fix · 1.33.0 CWE-835

TI-2024-01301 CVE-2024-1394 · GHSA-78hx-gp6g-7mj6

Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

LOW 36

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01533 Published 2024-03-21 Partial fix · 1.4.5-1.el8ap, 1.4.5-1.el9ap +91 CWE-401

TI-2024-18756 CVE-2024-28180 · GHSA-c5q2-7r4c-mv6g

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

LOW 26

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01956 Published 2024-03-09 Partial fix · 4.0.1, 3.0.3 +1 CWE-409