Red Hat Security Advisory: OpenShift Container Platform 4.13.42 packages and security update

Fixed packages 30

Vulnerabilities 2

• High 8.6
  CVE-2024-1753

  Buildah: buildah: container escape via improper bind mount validation

  A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mou…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Go
  Mar 18, 2024
• Medium 4.3
  CVE-2024-28180

  Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

  Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…

  go-jose go-jose zot kubescape Debian Azure Linux Alpine Wolfi Go
  Mar 9, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268854
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2877.json
• report
  https://access.redhat.com/security/cve/CVE-2024-1753
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1753
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1753
• article
  https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf
• article
  https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3
• advisory
  https://pkg.go.dev/vuln/GO-2024-2658
• report
  https://access.redhat.com/security/cve/CVE-2024-28180
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-28180
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-28180
• article
  https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g