This Red Hat security advisory (RHSA-2024:8677) addresses multiple security vulnerabilities in Red Hat OpenShift GitOps v1.12.6 and Red Hat OpenShift Pipelines Client 1.16.0. The vulnerabilities include a denial of service in body-parser (CVE-2024-45590), possible credential leak in follow-redirects (CVE-2024-28849), infinite loop in protojson.Unmarshal (CVE-2024-24786), sensitive information leakage to logs in go-retryablehttp (CVE-2024-6104), improper sanitization in serve-static (CVE-2024-43800), improper input handling in Express redirects (CVE-2024-43796), and code execution vulnerability in the Send library (CVE-2024-43799), among others. The advisory covers multiple architectures and product variants. The update is classified as important and addresses these vulnerabilities by providing patched versions of the affected components. The advisory references multiple CVEs and provides guidance to apply the update after prior errata are installed.

The vulnerabilities addressed in this advisory have a high security impact, including denial of service, credential leaks, infinite loops causing potential service disruption, improper input handling leading to possible security bypass, and code execution risks. These issues could allow attackers to disrupt service availability, leak sensitive information, or execute arbitrary code within the affected OpenShift GitOps environment. The advisory rates the overall impact as important, reflecting significant risk to affected systems if unpatched.

A security update to Red Hat OpenShift GitOps v1.12.6 and OpenShift Pipelines Client 1.16.0 is available and should be applied. Before applying this update, ensure all previously released errata relevant to your system have been installed. Follow Red Hat's official guidance for applying updates at https://access.redhat.com/articles/11258. Applying this update will remediate the listed vulnerabilities. No additional vendor mitigation instructions indicate that other actions are required.