Red Hat Security Advisory

RHSA-2024:6687

OpenShift Container Platform 4.16.13 bug fix and security update

Released 2024-09-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.16 openshift4/ose-docker-builder-rhel9, openshift4/ose-openshift-controller-manager-rhel9

Fixes 3 records

TI-2024-06847 CVE-2024-7387 · GHSA-qqv8-ph7f-h3f7

Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategy

HIGH 74

A flaw was found in openshift/builder.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.02321 Published 2024-09-16 Fixed in v4.12.0-202409121032.p1.g609473f.assembly.stream.el8, v4.13.0-202409120505.p1.g2c7e99d.assembly.stream.el8 +167 CWE-250

TI-2024-30536 CVE-2024-45496 · GHSA-j8gh-87rx-c7w9

Openshift-controller-manager: elevated build pods can lead to node compromise in openshift

MEDIUM 45

A flaw was found in OpenShift.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01016 Published 2024-09-16 Fixed in v4.12.0-202409131137.p1.g0b1971a.assembly.stream.el8, v4.13.0-202409130707.p1.gb75d499.assembly.stream.el8 +168 CWE-269

TI-2024-18756 CVE-2024-28180 · GHSA-c5q2-7r4c-mv6g

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

LOW 26

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01956 Published 2024-03-09 Partial fix · 4.0.1, 3.0.3 +1 CWE-409