Red Hat Security Advisory: OpenShift Container Platform 4.14.24 packages and security update

Fixed packages 34

Vulnerabilities 4

• High 8.6
  CVE-2024-1753

  Buildah: buildah: container escape via improper bind mount validation

  A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mou…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Go
  Mar 18, 2024
• High 7.5
  CVE-2023-45288 Public exploit EPSS 89%

  HTTP/2 CONTINUATION flood in net/http

  An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 4, 2024
• High 7.2
  CVE-2024-3154

  Cri-o: arbitrary command injection via pod annotation

  A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

  Red Hat Red Hat OpenShift Container Platform 4.14 Red Hat OpenShift Container Platform 4.15 Red Hat OpenShift Container Platform 4.13 Azure Linux Wolfi Go
  Apr 26, 2024
• Medium 4.3
  CVE-2024-28180

  Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

  Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…

  go-jose go-jose zot kubescape Debian Azure Linux Alpine Wolfi Go
  Mar 9, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268854
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2272532
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2672.json
• report
  https://access.redhat.com/security/cve/CVE-2023-45288
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45288
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45288
• article
  https://nowotarski.info/http2-continuation-flood/
• advisory
  https://pkg.go.dev/vuln/GO-2024-2687
• advisory
  https://www.kb.cert.org/vuls/id/421644
• report
  https://access.redhat.com/security/cve/CVE-2024-1753
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1753
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1753
• article
  https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf
• article
  https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3
• advisory
  https://pkg.go.dev/vuln/GO-2024-2658
• report
  https://access.redhat.com/security/cve/CVE-2024-3154
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3154
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3154
• article
  https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j
• article
  https://github.com/opencontainers/runc/pull/4217
• article
  https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson
• report
  https://access.redhat.com/security/cve/CVE-2024-28180
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-28180
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-28180
• article
  https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g