Red Hat Security Advisory

RHSA-2024:5094

Red Hat OpenShift Service Mesh Containers for 2.6.0 security update

Released 2024-08-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHOSSM 2.6 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +6
RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9

Fixes 4 records

TI-2024-16306 CVE-2024-24789 · GHSA-236w-p7wf-5ph8

Mishandling of corrupt central directory record in archive/zip

MEDIUM 58

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00443 Published 2024-06-05 Partial fix · 1.21.11, 1.22.4

TI-2024-14782 CVE-2024-22189 · GHSA-c33x-xqrf-c478

QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

MEDIUM 41

quic-go is an implementation of the QUIC protocol in Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01109 Published 2024-04-04 Partial fix · 0.42.0 CWE-770

TI-2018-09052 CVE-2018-12608 · GHSA-qrqr-3x5j-2xw9

An issue was discovered in Docker Moby before 17.06.0.

LOW 35

An issue was discovered in Docker Moby before 17.06.0.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0092 Published 2018-09-10 Partial fix · 17.06.0-ce CWE-295

TI-2024-18754 CVE-2024-28176 · GHSA-hhhv-q57g-882q

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

LOW 31

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02102 Published 2024-03-09 Partial fix · 2.0.7, 4.15.5 CWE-400