Red Hat Security Advisory

RHSA-2024:7941

OpenShift Container Platform 4.13.z security update

Released 2024-10-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Ironic content for Red Hat OpenShift Container Platform 4.13 openstack-ironic-1:21.3.1-0.20240911165036.c0d61d0.el9, openstack-ironic-api-1:21.3.1-0.20240911165036.c0d61d0.el9, openstack-ironic-common-1:21.3.1-0.20240911165036.c0d61d0.el9 +5
Red Hat OpenShift Container Platform 4.13 podman-3:4.4.1-13.rhaos4.13.el8, podman-3:4.4.1-14.rhaos4.13.el9, podman-catatonit-3:4.4.1-13.rhaos4.13.el8 +14

Fixes 3 records

TI-2024-03473 CVE-2024-3727 · GHSA-6wvf-f2vw-3425

Containers/image: digest type does not guarantee valid type

LOW 39

A flaw was found in the github.com/containers/image library.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.01279 Published 2024-05-09 Partial fix · 5.29.3, 5.30.1 +66 CWE-354

TI-2024-28340 CVE-2024-42353 · GHSA-mg3v-6m49-jhp3

WebOb's location header normalization during redirect leads to open redirect

LOW 28

WebOb provides objects for HTTP requests and responses.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00569 Published 2024-08-14 Partial fix · 1.8.8 CWE-601

TI-2024-29664 CVE-2024-44082

In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a…

LOW 21

In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qem…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00545 Published 2024-09-06 Partial fix CWE-862