Red Hat Security Advisory

RHSA-2024:8991

OpenShift Container Platform 4.15.38 bug fix and security update

Released 2024-11-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.15 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-console, openshift4/ose-monitoring-plugin-rhel8 +1

Fixes 4 records

TI-2024-06036 CVE-2024-6508 · GHSA-4crf-28c7-v4gr

Openshift-console: oauth2 insufficient state parameter entropy

HIGH 70

An insufficient entropy vulnerability was found in the Openshift Console.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00673 Published 2024-08-21 Fixed in v4.12.0-202412201659.p0.g8910d84.assembly.stream.el8, v4.13.0-202411300029.p0.g68accd9.assembly.stream.el8 +167 CWE-331

TI-2024-32129 CVE-2024-47875 · GHSA-gx9m-whjm-85jf

DOMPurify nesting-based mXSS

MEDIUM 45

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01134 Published 2024-10-11 Partial fix · 2.5.0, 3.1.3 CWE-79

TI-2024-06865 CVE-2024-7409 · GHSA-7c7g-wccp-rrhj

Qemu: denial of service via improper synchronization in qemu nbd server during socket closure

MEDIUM 41

A flaw was found in the QEMU NBD Server.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01027 Published 2024-08-05 Partial fix · 7.2.0, 8.2.0 +12 CWE-662

TI-2023-24163 CVE-2023-45142 · GHSA-rcjv-mgp8-qvmr

OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

LOW 36

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01614 Published 2023-10-12 Partial fix · 0.44.0 CWE-770