Red Hat Security Advisory: OpenShift Container Platform 4.12.63 packages and security update

Fixed packages 32

Vulnerabilities 3

• Critical 9.8
  CVE-2024-24790

  Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

  The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

  Go standard library net/netip golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 5, 2024
• High 7.5
  CVE-2024-37298

  Potential memory exhaustion attack due to sparse slice deserialization

  gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the spars…

  gorilla schema zot telegraf Debian Ubuntu Azure Linux Wolfi Go
  Jul 1, 2024
• Medium 6.5
  CVE-2023-45290

  Memory exhaustion in multipart form parsing in net/textproto and net/http

  When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

  Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268017
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2292787
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295010
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5202.json
• report
  https://access.redhat.com/security/cve/CVE-2023-45290
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45290
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45290
• article
  http://www.openwall.com/lists/oss-security/2024/03/08/4
• article
  https://go.dev/cl/569341
• article
  https://go.dev/issue/65383
• article
  https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• advisory
  https://pkg.go.dev/vuln/GO-2024-2599
• article
  https://security.netapp.com/advisory/ntap-20240329-0004
• report
  https://access.redhat.com/security/cve/CVE-2024-24790
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24790
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24790
• report
  https://access.redhat.com/security/cve/CVE-2024-37298
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-37298
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-37298
• article
  https://github.com/gorilla/schema/blob/main/decoder.go#L223
• article
  https://github.com/gorilla/schema/commit/cd59f2f12cbdfa9c06aa63e425d1fe4a806967ff
• article
  https://github.com/gorilla/schema/security/advisories/GHSA-3669-72x9-r9p3