This advisory concerns Red Hat Service Interconnect 1.4 LTS container images for RHEL 9, which have been updated to include backported patches for multiple security vulnerabilities identified by several CVEs (including CVE-2024-2398, CVE-2024-6345, CVE-2024-6923, among others). The vulnerabilities addressed include a curl HTTP/2 push headers memory leak, glib2 signal subscription issues, krb5 GSS message token handling flaws, remote code execution in pypa/setuptools, and email header injection in Python's email module. Users are recommended to upgrade to these updated container images and rebuild dependent images to ensure these fixes are applied.

The vulnerabilities addressed range from memory leaks and signal subscription issues to remote code execution and header injection, which could potentially affect the confidentiality, integrity, or availability of systems running the affected container images. However, the overall severity is rated as low by Red Hat, and there are no known exploits in the wild. The impact is mitigated by applying the updated container images.

Red Hat has released updated container images containing backported patches that fix the identified security issues. Users should upgrade to these updated service-interconnect 1.4 LTS RHEL 9 container images and rebuild all container images that depend on them. Before applying this update, ensure all previously released relevant errata have been applied. Detailed update instructions are available in the Red Hat advisory. Patch status is confirmed as available via updated container images.