Threats Tagged 'cve-2024-47211'

Red Hat OpenShift Container Platform 4. 17. 2 includes multiple security fixes addressing vulnerabilities in Golang components and OpenStack Ironic. These issues involve stack exhaustion panics caused by deeply nested structures or expressions (CVE-2024-34155, CVE-2024-34156, CVE-2024-34158) and improper handling of highly compressed data (CVE-2024-28180). Additionally, a lack of checksum validation on images in OpenStack Ironic (CVE-2024-47211) is addressed. The update is rated as having an important security impact by Red Hat. Users of OpenShift Container Platform 4. 17 are advised to upgrade to the fixed packages and images as provided by Red Hat.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.16.19. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2024:8418 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html Security Fix(es): * openshift-console: OAuth2 insufficient state parameter entropy (CVE-2024-6508) * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) * openstack-ironic: Lack of checksum validation on images (CVE-2024-47211) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2024-47211