The Red Hat OpenShift API for Data Protection (OADP) 1.4.5 update fixes several security vulnerabilities in dependencies such as golang.org/x/crypto/ssh, golang.org/x/net/html, go-git, golang.org/x/oauth2/jws, golang-jwt/jwt, go-jose, and net/http. Key issues include misuse of ServerConfig.PublicKeyCallback leading to potential authorization bypass (CVE-2024-45337), denial of service vulnerabilities in SSH key exchange and JOSE parsing, request smuggling in net/http, argument injection in go-git, and excessive memory allocation during JWT parsing. These vulnerabilities could impact the security of backup and restore operations managed by OADP. The update addresses these issues by incorporating fixes from the upstream Go libraries and related components. The affected versions are >=1.4.0 and <1.4.5. The vendor advisory confirms the availability of this update and recommends applying it after ensuring all prior errata are applied.

The vulnerabilities fixed in this update could allow attackers to bypass authorization controls, cause denial of service conditions, perform request smuggling attacks, inject arguments via URLs, or trigger excessive memory consumption during token parsing. These issues affect the security and reliability of backup and restore operations in OpenShift API for Data Protection, potentially exposing sensitive data or disrupting service availability. The update mitigates these risks by patching the underlying Go libraries and components used by OADP.

Red Hat has released OpenShift API for Data Protection (OADP) version 1.4.5 which includes security fixes for the listed vulnerabilities. Users should upgrade to version 1.4.5 after applying all previously released errata relevant to their system. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are required beyond applying this official update.