This advisory from Red Hat addresses security vulnerabilities in the service-interconnect 1.4 LTS container images for RHEL 9. The updated images contain backported patches that fix multiple CVEs: CVE-2024-2398 (curl HTTP/2 push headers memory leak), CVE-2024-34397 (glib2 signal subscription vulnerabilities), CVE-2024-37370 and CVE-2024-37371 (krb5 GSS message token handling), CVE-2024-6345 (remote code execution in pypa/setuptools), CVE-2024-6923 (email header injection in Python's email module), and others. Users are recommended to upgrade to these updated images and rebuild any container images that depend on them. The advisory does not provide a CVSS score but classifies the severity as low.

The vulnerabilities fixed include memory leaks, signal subscription issues, improper message token handling, remote code execution potential, and header injection flaws. While these issues could affect the security and stability of the service-interconnect container images, Red Hat rates the overall severity as low. There are no known exploits in the wild at this time.

Users should upgrade to the updated service-interconnect 1.4 LTS container images for RHEL 9 provided by Red Hat, which contain the necessary security patches. Additionally, users are encouraged to rebuild all container images that depend on these updated images to ensure full remediation. Before applying this update, ensure all previously released relevant errata have been applied. Refer to Red Hat's official documentation for update procedures.