Red Hat Security Advisory: OpenShift Container Platform 4.14.38 security update

Fixed packages 34

Vulnerabilities 2

• High 8.3
  CVE-2024-3727

  Containers/image: digest type does not guarantee valid type

  A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 9, 2024
• Medium 6.1
  CVE-2024-42353

  WebOb's location header normalization during redirect leads to open redirect

  WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. …

  Pylons webob webob python-webob Debian Ubuntu Azure Linux PyPI
  Aug 14, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2274767
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7187.json
• report
  https://access.redhat.com/security/cve/CVE-2024-3727
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3727
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3727
• report
  https://access.redhat.com/security/cve/CVE-2024-42353
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2305004
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-42353
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-42353
• article
  https://github.com/Pylons/webob
• article
  https://github.com/Pylons/webob/commit/f689bcf4f0a1f64f1735b1d5069aef5be6974b5b
• article
  https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3