Red Hat Security Advisory

RHSA-2024:8418

OpenShift Container Platform 4.16.z security update

Released 2024-10-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Ironic content for Red Hat OpenShift Container Platform 4.16 python-zipp-3.19.1-1.el9, python3-zipp-3.19.1-1.el9
Red Hat OpenShift Container Platform 4.16 cri-o-1.29.9-6.rhaos4.16.gite7bd45a.el8, cri-o-1.29.9-6.rhaos4.16.gite7bd45a.el9

Fixes 3 records

TI-2024-16307 CVE-2024-24790 · GHSA-49gw-vxvf-fc2g

Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

MEDIUM 53

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01952 Published 2024-06-05 Partial fix · 1.21.11, 1.22.4

TI-2024-08977 CVE-2024-9676 · GHSA-wq2p-5pc6-wpgf

Path traversal in containers/storage

LOW 32

A vulnerability was found in Podman, Buildah, and CRI-O.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01325 Published 2024-10-15 Partial fix · 1.55.1, 8100020241101101019.afee755d +181 CWE-22

TI-2024-05174 CVE-2024-5569 · GHSA-jfmj-5v4g-7637

Denial of Service via crafted zip file in jaraco/zipp

LOW 27

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1.

CVSS 3.0MEDIUM 6.2 Local No auth No interaction EPSS 0.00236 Published 2024-07-09 Partial fix · 3.19.1 CWE-835