Red Hat Security Advisory: OpenShift Container Platform 4.17.0 packages and security update

Fixed packages 36

Vulnerabilities 2

• Medium 6.0
  CVE-2024-6104

  go-retryablehttp can leak basic auth credentials to log files

  go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

  HashiCorp Shared library zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  Jun 24, 2024
• Medium 5.3
  CVE-2024-24789

  Mishandling of corrupt central directory record in archive/zip

  The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file…

  Go standard library archive/zip golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 5, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2292668
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2294000
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3722.json
• report
  https://access.redhat.com/security/cve/CVE-2024-6104
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-6104
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-6104
• report
  https://access.redhat.com/security/cve/CVE-2024-24789
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24789
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24789