Red Hat Security Advisory: OpenShift Container Platform 4.15.12 security update

Fixed packages 30

Vulnerabilities 3

• High 8.6
  CVE-2024-1753

  Buildah: buildah: container escape via improper bind mount validation

  A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mou…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Go
  Mar 18, 2024
• High 7.2
  CVE-2024-3154

  Cri-o: arbitrary command injection via pod annotation

  A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

  Red Hat Red Hat OpenShift Container Platform 4.14 Red Hat OpenShift Container Platform 4.15 Red Hat OpenShift Container Platform 4.13 Azure Linux Wolfi Go
  Apr 26, 2024
• Medium 4.3
  CVE-2024-28180

  Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

  Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…

  go-jose go-jose zot kubescape Debian Azure Linux Alpine Wolfi Go
  Mar 9, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268854
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2272532
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2669.json
• report
  https://access.redhat.com/security/cve/CVE-2024-1753
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1753
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1753
• article
  https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf
• article
  https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3
• advisory
  https://pkg.go.dev/vuln/GO-2024-2658
• report
  https://access.redhat.com/security/cve/CVE-2024-3154
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3154
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3154
• article
  https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j
• article
  https://github.com/opencontainers/runc/pull/4217
• article
  https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson
• report
  https://access.redhat.com/security/cve/CVE-2024-28180
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-28180
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-28180
• article
  https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g