This advisory addresses multiple security vulnerabilities in Red Hat OpenShift Container Platform, specifically versions 4.15 and 4.16 prior to 4.15.33 and 4.16.13. The key vulnerabilities include CVE-2024-7387, a path traversal vulnerability in the openshift/builder component that allows command injection in privileged BuildContainers using the docker build strategy, and CVE-2024-45496, where elevated build pods can lead to node compromise via the openshift-controller-manager. Additionally, CVE-2024-28180 involves improper handling of highly compressed data in the jose-go library. Red Hat has released updated container images to fix these issues. The advisory provides detailed instructions and references for upgrading clusters and inspecting release image metadata across multiple architectures.

Successful exploitation of CVE-2024-7387 could allow an attacker with access to privileged BuildContainers to perform command injection via path traversal, potentially leading to unauthorized code execution. CVE-2024-45496 could allow elevated build pods to compromise the underlying node, impacting cluster integrity and security. CVE-2024-28180 involves improper handling of compressed data, which may lead to denial of service or other impacts depending on usage. These vulnerabilities pose a high security risk to affected OpenShift Container Platform deployments prior to the fixed versions.

Red Hat has released fixed container images in OpenShift Container Platform versions 4.15.33 and 4.16.13 that address these vulnerabilities. Users should upgrade their clusters to these versions or later as soon as possible using the OpenShift CLI (oc) or web console. Detailed upgrade instructions are available in the official Red Hat OpenShift documentation. No additional mitigations are specified beyond applying these official updates.