A flaw in the golang-protobuf module's protojson.Unmarshal function can cause an infinite loop when unmarshaling certain malformed JSON inputs. This occurs specifically when unmarshaling messages that include google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. An attacker could exploit this by providing crafted invalid JSON input, causing the function to consume excessive CPU or memory resources, resulting in a denial of service condition. Red Hat OpenShift Container Platform 4.14 versions up to 4.14.17 are affected. Red Hat has issued a security advisory (RHSA-2024:1362) with updated container images and packages to fix the vulnerability. The CVSS v3 base score assigned by Red Hat is 5.9 (medium severity), reflecting a network attack vector with high complexity and no privileges or user interaction required. No known exploits are reported in the wild. Mitigation options other than applying the update are not considered practical or effective by Red Hat.

The vulnerability can cause an infinite loop during JSON unmarshaling in affected golang-protobuf components, leading to high CPU and memory consumption. This results in a denial of service condition, potentially degrading or halting the operation of affected OpenShift Container Platform components. There is no impact on confidentiality or integrity. The attack requires sending specially crafted invalid JSON input to the vulnerable component.

Red Hat has released updated packages and container images for OpenShift Container Platform 4.14.17 that fix this vulnerability. Users should apply these updates following Red Hat's official guidance. No other mitigations are currently recommended or available that meet Red Hat's criteria for ease of use and applicability. Ensure all previously released errata relevant to your system have been applied before updating.