CVE-2024-12085VulnerabilityPublished 12 Feb 2025Updated 5 Nov 2026

Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.9.11

Affects Red HatSource GCVE Database

Compare

Mentioned vulnerabilities

CVE-2024-47220

Not known to be exploited.

Data as of 5 Nov 2026, 15:02 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

Exploitation evidence

Disclosed: evidence found.
CVE published 12 Feb 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Red Hat has released a fixed version of the Logging subsystem for OpenShift 5.9.11 that addresses these vulnerabilities. Users should follow Red Hat's official upgrade instructions for OpenShift Container Platform 4.14 and the Logging 5.9 subsystem to apply this update. No additional mitigation steps are indicated beyond applying the official patch. The vendor manages remediation through this update; users should consult the Red Hat advisory and documentation links for detailed upgrade procedures.

Description

Red Hat OpenShift Logging 5.9.11 addresses two security vulnerabilities: an HTTP request smuggling flaw in the logging-fluentd-container (CVE-2024-47220) and an information leak caused by uninitialized stack contents in the cluster-logging-operator-container (CVE-2024-12085). These issues affect the logging subsystem for Red Hat OpenShift on multiple architectures. The vulnerabilities have been fixed in this update, and Red Hat provides upgrade instructions to apply the errata.

Impact

Successful exploitation of CVE-2024-47220 could allow an attacker to perform HTTP request smuggling attacks, potentially bypassing security controls or interfering with request handling. CVE-2024-12085 could lead to information disclosure through leakage of uninitialized stack data. Both vulnerabilities pose a high security risk to the confidentiality and integrity of the logging infrastructure within Red Hat OpenShift environments.

CWE-908Use of Uninitialized Resource (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product uses or accesses a resource that has not been initialized.
Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
Implementation
Avoid race conditions (CWE-362) during initialization routines.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-444Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Implementation
Use a web server that employs a strict HTTP parsing procedure, such as Apache.
Implementation
Use only SSL communication.
Implementation
Terminate the client session after each request.
OWASP Cheat Sheets
REST Assessment (opens in a new tab)
REST Security (opens in a new tab)
Cross-Site Request Forgery Prevention (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V13.2.5 (opens in a new tab)
Attack patterns
HTTP Response Smuggling (opens in a new tab)
HTTP Request Smuggling (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 5 Nov 2026, 15:02 UTC

Public exploits and detectionGitHub proofs of concept

WeaknessesCWE-908, CWE-444

Technical details

References

Community reviews

Related threats