This advisory covers security updates for Red Hat Service Interconnect 1 container images based on RHEL 9. It includes fixes for six CVEs: CVE-2024-2398 (curl HTTP/2 push headers memory leak), CVE-2024-34397 (glib2 signal subscription vulnerabilities), CVE-2024-37370 and CVE-2024-37371 (krb5 GSS message token handling), CVE-2024-6345 (remote code execution via pypa/setuptools package_index module), and CVE-2024-6923 (email header injection in Python's email module). The updated images are available in the Red Hat Container Catalog. Users should apply all prior relevant errata before updating and rebuild dependent container images to ensure full remediation.

The vulnerabilities addressed range from memory leaks and signal handling issues to remote code execution and header injection. While the advisory rates the overall severity as low, some issues like remote code execution (CVE-2024-6345) and header injection (CVE-2024-6923) could potentially be exploited if the affected components are exposed or used improperly. No active exploitation is known. The impact is mitigated by updating to the patched container images.

Red Hat has released updated service-interconnect RHEL 9 container images containing backported security patches. Users should upgrade to these updated images as soon as possible. Additionally, it is recommended to rebuild all container images that depend on these updated images to ensure all components are patched. Before applying this update, users should ensure all previously released errata relevant to their system are applied. Detailed update instructions are available from Red Hat's official documentation.