This advisory covers three security fixes in the Kube Descheduler Operator for Red Hat OpenShift 5.1.0 on RHEL 9. The vulnerabilities are: CVE-2024-24788, a malformed DNS message in golang net package that can cause an infinite loop; CVE-2024-24790, unexpected behavior in net/netip Is methods for IPv4-mapped IPv6 addresses; and CVE-2024-24791, a denial of service vulnerability in net/http due to improper handling of 100-continue requests. These flaws stem from golang libraries used by the operator and may affect its pod eviction functionality. The advisory references Red Hat Bugzilla entries and recommends applying the update after ensuring all prior errata are applied.

The vulnerabilities may cause denial of service conditions or unexpected behavior in the Kube Descheduler Operator due to malformed DNS messages, IP address handling issues, or HTTP request processing errors. This could disrupt pod eviction strategies managed by the operator, potentially impacting cluster stability or workload scheduling. No known exploits in the wild have been reported. The overall severity is rated moderate by Red Hat.

Red Hat has released an updated version of the Kube Descheduler Operator 5.1.0 for RHEL 9 that addresses these vulnerabilities. Users should ensure all previously released errata are applied before updating to this fixed version. No additional mitigation steps are indicated beyond applying the official update as per Red Hat's advisory RHSA-2024:6341.