Red Hat Security Advisory: RHOAI 2.25.9 - Red Hat OpenShift AI

CVE-2024-12224 affects the idna crate by allowing hostname spoofing through specially crafted Punycode labels that decode to ASCII or empty labels, leading to improper equality checks during hostname validation. This can enable attackers to bypass hostname checks and potentially escalate privileges under specific conditions. The vulnerability is rated moderate by Red Hat due to the complexity of exploitation and required conditions. No official fix or mitigation currently meets Red Hat's standards, but updated images for Red Hat OpenShift AI 2.25.9 have been released with other changes. The issue is tracked under CWE-1289 (Improper Validation of Unsafe Equivalence in Input).

The vulnerability allows attackers to spoof hostnames by exploiting improper validation of Punycode labels, potentially bypassing hostname checks and leading to limited privilege escalation. It does not impact system availability. Exploitation requires a client that accepts unusual domain names and attacker control of a matching DNS entry. The risk is considered moderate due to these constraints.

Currently, no mitigation or patch meets Red Hat's criteria for ease of use, deployment, or applicability. Users should follow Red Hat's official upgrade instructions for Red Hat OpenShift AI 2.25.9 to apply the latest updates and monitor Red Hat advisories for future fixes or mitigations. Customers with a Red Hat Technical Account Manager (TAM) can consult directly for tailored guidance.