Threats Tagged 'cve-2024-24790'

Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.25 release is based on Eclipse Che 7.111 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2. Users still using the v1 standard should migrate as soon as possible. https://devfile.io/docs/2.2.0/migrating-to-devfile-v2 Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates. https://access.redhat.com/support/policy/updates/openshift#crw

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. This new container image is based on Red Hat Ceph Storage 7.1 and Red Hat Enterprise Linux 9.5, 9.4, 8.10. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on the most significant of these changes: https://docs.redhat.com/en/documentation/red_hat_ceph_storage/7/html/7.1_release_notes All users of Red Hat Ceph Storage are advised to pull these new images from the Red Hat Ecosystem catalog, which provides numerous enhancements and bug fixes.

Release of RHOAI 2.17.0 provides these changes:

Red Hat Update Infrastructure (RHUI) provides a highly scalable and redundant framework for managing repositories and content. It also allows cloud providers to deliver content and updates to Red Hat Enterprise Linux (RHEL) instances. Security Fixes: * Cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override (CVE-2024-26130) * Gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers (CVE-2024-1135) * Aiohttp: aiohttp: XSS on index pages for static file handling (CVE-2024-27306) * Aiohttp: aiohttp: DoS when trying to parse malformed POST requests (CVE-2024-30251) * Sqlparse: sqlparse: parsing heavily nested list leads to denial of service (CVE-2024-4340) * Jinja2: jinja2: accepts keys containing non-attribute characters (CVE-2024-34064) * Django: Potential denial-of-service in django.utils.translation.get_supported_language_variant() (CVE-2024-39614) * Django: Memory exhaustion in django.utils.numberformat.floatformat() (CVE-2024-41989) * Django: Potential SQL injection in QuerySet.values() and values_list() (CVE-2024-42005) * Django: Potential denial-of-service vulnerability in django.utils.html.urlize() (CVE-2024-41990) * Django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget (CVE-2024-41991) * Grpcio: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the backend (CVE-2024-7246) * Requests: subsequent requests to the same host ignore cert verification (CVE-2024-35195) For detailed information on other changes in this release, see the Red Hat Update Infrastructure Release Notes linked from the References section.

This errata advisory is for publishing the GA release of Helm 3.15.4 for OpenShift Container Platform 4.17 version.

This release of RHACS 4.4.6 introduces the following changes: Bug fix: * Fixed an issue where you could not view detailed scan results for certain images in RHACS because the page redirected to an error after a brief display. (ROX-24326) Security fixes: * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156) * body-parser: Denial of Service Vulnerability in body-parser (CVE-2024-45590) * dompurify: DOMPurify vulnerable to tampering by prototype pollution (CVE-2024-48910) * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789) * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

The Kube Descheduler Operator for Red Hat OpenShift is an optional operator that deploys the descheduler, which is responsible for evicting pods based on certain strategies. Security Fix(es): * golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788) * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790) * net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

Cluster Observability Operator Security Fix(es): * coo-prometheus-container: go-retryablehttp: url might write sensitive information to log file [coo-0] (CVE-2024-6104) * coo-thanos-container: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [coo-0] (CVE-2024-24786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s)listed in the References section.

Red Hat Developer Hub (RHDH) is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features of RHDH include a single pane of glass, a centralized software catalog, self-service via golden path templates, and Tech Docs. RHDH is extensible by plugins.