This advisory covers security fixes in Red Hat OpenShift Container Platform 4.17.12, specifically addressing three CVEs: CVE-2024-21626 (runc file descriptor leak), CVE-2024-45338 (non-linear parsing of case-insensitive content in golang.org/x/net/html), and CVE-2024-50312 (information disclosure via GraphQL introspection). The update includes container image and package fixes for multiple architectures including x86_64, s390x, ppc64le, and aarch64. Red Hat rates the security impact as Important and provides detailed upgrade instructions. The vulnerabilities impact the OpenShift Container Platform 4.17 release and are fixed in this update.

The vulnerabilities fixed in this update include a file descriptor leak that could lead to resource exhaustion (CVE-2024-21626), a parsing issue that could affect processing of HTML content (CVE-2024-45338), and an information disclosure vulnerability through GraphQL introspection (CVE-2024-50312). The CVSS vector for CVE-2024-21626 indicates local attack vector with low complexity and no privileges required but user interaction needed, with high confidentiality, integrity, and availability impact. These issues could allow attackers to gain sensitive information or disrupt service on affected OpenShift Container Platform 4.17 deployments.

Red Hat has released OpenShift Container Platform 4.17.12 containing fixes for these vulnerabilities. Users of OpenShift Container Platform 4.17 should upgrade to this version using the OpenShift CLI (oc) or web console as soon as the updated packages and container images are available in their release channel. Detailed upgrade instructions are provided by Red Hat at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html. No alternative mitigations or workarounds are specified; applying the official update is the recommended remediation.