Red Hat Security Advisory: OpenShift Container Platform 4.13.53 packages and security update

Fixed packages 89

Vulnerabilities 7

• High 7.8
  CVE-2024-9675

  Buildah: buildah allows arbitrary directory mount

  A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) int…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Linux Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 9, 2024
• High 7.5
  CVE-2024-34156

  Stack exhaustion in Decoder.Decode in encoding/gob

  Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

  Go standard library encoding/gob katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2024
• High 7.5
  CVE-2024-34158

  Stack exhaustion in Parse in go/build/constraint

  Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

  Go standard library go/build/constraint katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2024
• High 7.4
  CVE-2025-4953

  Podman: build context bind mount

  A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on th…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Go
  Sep 16, 2025
• Medium 6.5
  CVE-2024-9676

  Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

  A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an au…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9.4 Extended Update Support Linux Debian Ubuntu Azure Linux Alpine
  Oct 15, 2024
• Medium 5.4
  CVE-2024-9341

  Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

  A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the sy…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat OpenShift Container Platform 4.14 Linux Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 1, 2024
• Medium 4.3
  CVE-2024-34155

  Stack exhaustion in all Parse functions in go/parser

  Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

  Go standard library go/parser katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2310527
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2310528
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2310529
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315691
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2317458
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2317467
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8690.json
• report
  https://access.redhat.com/security/cve/CVE-2024-9341
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9341
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9341
• article
  https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L169
• article
  https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L349
• report
  https://access.redhat.com/security/cve/CVE-2024-9675
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9675
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9675
• report
  https://access.redhat.com/security/cve/CVE-2024-9676
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9676
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9676
• advisory
  https://github.com/advisories/GHSA-wq2p-5pc6-wpgf
• article
  https://github.com/containers/storage/commit/935c58f4b3e364a9c9d33ed06476a831e6ad5679
• report
  https://access.redhat.com/security/cve/CVE-2024-34155
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34155
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34155
• article
  https://go.dev/cl/611238
• article
  https://go.dev/issue/69138
• article
  https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
• advisory
  https://pkg.go.dev/vuln/GO-2024-3105
• report
  https://access.redhat.com/security/cve/CVE-2024-34156
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34156
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34156
• article
  https://go.dev/cl/611239
• article
  https://go.dev/issue/69139
• advisory
  https://pkg.go.dev/vuln/GO-2024-3106
• report
  https://access.redhat.com/security/cve/CVE-2024-34158
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34158
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34158
• article
  https://go.dev/cl/611240
• article
  https://go.dev/issue/69141