CVE-2024-3177VulnerabilityPublished 27 Jun 2024Updated 25 Oct 2026

Red Hat Security Advisory: Red Hat build of MicroShift 4.16.0 security update

Affects Red HatSource GCVE Database

Mentioned vulnerabilities

CVE-2024-24786

Not known to be exploited : upgrade Red Hat to 4.16.1 or 4.14.23 soon.

Data as of 26 Oct 2026, 10:12 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 2.2% chance of exploitation in 30 days – higher than 82% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 4.16.1, 4.14.23

Exploitation evidence

Disclosed: evidence found.
CVE published 27 Jun 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Red Hat to 4.16.1 or 4.14.23.

Affected software

Product	Affected	Fixed in
Red Hat Product Security Red Hat	Affected >=4.14.0 <4.14.23 >=4.16.0 <4.16.1 Red Hat Red Hat OpenShift Enterprise Red Hat OpenShift Container Platform 4.16 src microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src Red Hat OpenShift Container Platform 4.14	Fixed in 4.14.23 4.16.1

AI-suggested

A vendor-provided official fix is available. Users of Red Hat build of MicroShift 4.16.0 should promptly update to the latest RPM packages and container images as provided in the Red Hat RPM repository and follow the installation instructions in the official documentation. No additional mitigations are indicated by the vendor advisory.

Description

Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge device deployments and is built from the edge capabilities of Red Hat OpenShift Container Platform. MicroShift is an application that is deployed on top of Red Hat Enterprise Linux devices at the edge, providing an efficient way to operate single-node clusters in these low-resource environments. This advisory contains the RPM packages for Red Hat build of MicroShift 4.16.0. Read the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2024:0041 Security Fix(es): * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) * kubernetes: kube-apiserver: bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (CVE-2024-3177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Impact

The vulnerabilities fixed in this update could cause denial of service via an infinite loop when unmarshaling invalid JSON data (CVE-2024-24786) and unauthorized bypass of mountable secrets policy in Kubernetes API server (CVE-2024-3177). These issues could compromise the security controls around secret management and potentially affect cluster stability. Red Hat rates the overall security impact of the MicroShift 4.16.0 update as Important (high). There are no known exploits in the wild at this time.

Summary

This advisory covers security updates for Red Hat build of MicroShift 4.16.0, addressing two main vulnerabilities: CVE-2024-24786, which is an infinite loop in golang-protobuf's protojson.Unmarshal when processing certain invalid JSON inputs, and CVE-2024-3177, which allows bypassing the mountable secrets policy enforced by the Kubernetes ServiceAccount admission plugin in kube-apiserver. The update includes RPM packages and container images to remediate these issues. The advisory also references related bug fixes and enhancements for MicroShift 4.16.0. Red Hat OpenShift Container Platform 4.14 also received related security updates, but with a Moderate impact rating. The vendor advisory confirms the availability of updated packages and provides instructions for installation and upgrade.

CWE-213Exposure of Sensitive Information Due to Incompatible Policies (opens in a new tab)
Base weaknessOWASP Top 10 A04:2021: Insecure Design (opens in a new tab)
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
OWASP Cheat Sheets
Error Handling (opens in a new tab)
Logging (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.4 (opens in a new tab)
V14.3.3 (opens in a new tab)
V7.3.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop') (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-409Improper Handling of Highly Compressed Data (Data Amplification) (opens in a new tab)
Base weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.2 (opens in a new tab)
V12.1.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 22:39 UTC

WeaknessesCWE-213, CWE-835, CWE-409

Technical details

References

Community reviews

Related threats