Red Hat Security Advisory

RHSA-2024:2877

OpenShift Container Platform 4.13.42 packages and security update

Released 2024-05-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.13 cri-o-1.26.5-15.2.rhaos4.13.gitb742e63.el8, cri-o-1.26.5-15.2.rhaos4.13.gitb742e63.el9, podman-3:4.4.1-7.3.rhaos4.13.el8 +12

Fixes 2 records

TI-2024-01631 CVE-2024-1753 · GHSA-874v-pj72-92f3

Buildah: buildah: container escape via improper bind mount validation

HIGH 72

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00457 Published 2024-03-18 Partial fix · 8090020240413110917.d7b6f4b7, 8090020240417184044.e7857ab1 +17 CWE-59

TI-2024-18756 CVE-2024-28180 · GHSA-c5q2-7r4c-mv6g

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

LOW 26

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01956 Published 2024-03-09 Partial fix · 4.0.1, 3.0.3 +1 CWE-409