This advisory for Red Hat OpenShift Container Platform 4.17.15 addresses two security vulnerabilities: CVE-2024-9676, a symlink traversal vulnerability in the containers/storage library used by Podman, Buildah, and CRI-O that can lead to Denial of Service (DoS); and CVE-2024-52798, an unpatched Regular Expression Denial of Service (ReDoS) vulnerability in path-to-regexp version 0.1.x. The update includes fixed container images and RPM packages to resolve these issues. Red Hat rates the security impact as moderate and recommends upgrading to the fixed versions available via the appropriate release channels. Detailed upgrade instructions and image digests are provided by Red Hat. No known exploits in the wild have been reported at this time.

The symlink traversal vulnerability (CVE-2024-9676) can cause Denial of Service in container-related tools (Podman, Buildah, CRI-O) by exploiting the containers/storage library. The path-to-regexp vulnerability (CVE-2024-52798) can lead to a Regular Expression Denial of Service (ReDoS) in affected versions of the path-to-regexp library. Both vulnerabilities can disrupt normal operations of the OpenShift Container Platform environment, potentially impacting availability.

Red Hat has released updated container images and RPM packages in OpenShift Container Platform 4.17.15 that address these vulnerabilities. Users should upgrade their OpenShift Container Platform 4.17 clusters to version 4.17.15 using the OpenShift CLI (oc) or web console as per Red Hat's official upgrade instructions. The vendor manages remediation through these updates. There are no indications that additional mitigation steps are required beyond applying the official update.