This advisory covers multiple security vulnerabilities in Red Hat OpenShift Service Mesh Containers 2.5.0 through 2.5.5. Notable issues include CVE-2024-23326 where Envoy incorrectly accepts HTTP 200 responses for entering upgrade mode, CVE-2024-30255 involving HTTP/2 CPU exhaustion via CONTINUATION frame flood, CVE-2024-43799 a code execution vulnerability in the send library, and CVE-2024-43800 improper sanitization in serve-static. Other vulnerabilities include denial of service in body-parser (CVE-2024-45590), DOM clobbering in webpack (CVE-2024-43788), and multiple Envoy-related issues such as infinite loops and header manipulation. These vulnerabilities collectively pose risks including code execution, denial of service, and potential header manipulation attacks. Red Hat has issued fixes in the updated 2.5.5 release.

The vulnerabilities impact the security and stability of Red Hat OpenShift Service Mesh Containers by enabling potential code execution, denial of service, and manipulation of HTTP headers. The Envoy component is affected by multiple issues that could lead to abnormal termination, CPU exhaustion, and improper HTTP upgrade handling. The send library vulnerability allows code execution, while serve-static's improper sanitization could lead to security bypasses. The body-parser flaw can cause denial of service conditions. These issues collectively increase the risk of service disruption and unauthorized code execution within affected environments.

Red Hat has released an updated version 2.5.5 of OpenShift Service Mesh Containers that addresses all listed vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their system are applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are specified beyond applying the official update.