Red Hat Product Security has issued advisories (RHSA-2024:6311 and RHSA-2026:33154) addressing multiple vulnerabilities affecting Red Hat Ceph Storage 7.1 and Red Hat Enterprise Linux 8 High Availability and Resilient Storage packages. Notably, CVE-2024-6345 describes a remote code execution vulnerability in the pypa/setuptools package_index module's download functions. CVE-2024-37891 involves urllib3 not stripping proxy-authorization headers during cross-origin redirects. The advisories provide updated resource-agents packages and updated container images based on ubi9 and Ceph 7.1. The updates fix these vulnerabilities and others listed in the advisories. No CVSS scores are provided, but the severity is rated moderate to high. No exploits in the wild are known. The vendor recommends applying the updated packages and pulling the updated container images from the Red Hat container registry.

Successful exploitation of CVE-2024-6345 could allow remote code execution via maliciously crafted downloads using the setuptools package_index module. CVE-2024-37891 could lead to information disclosure or misuse of proxy-authorization headers during redirects. Other listed CVEs may have varying impacts but are not detailed here. The vulnerabilities affect critical components used in high-availability and resilient storage environments, potentially impacting system stability and security if left unpatched. No active exploitation has been reported.

Red Hat has released updated packages for resource-agents and updated container images for Red Hat Ceph Storage 7.1 and related products. Users should apply these updates promptly by following Red Hat's official guidance at https://access.redhat.com/articles/11258 and pulling updated container images from the Red Hat container registry using podman or similar tools. The vendor manages remediation for these products and provides official fixes. No additional mitigation steps are indicated beyond applying the official updates.