Threats Tagged 'cve-2024-50302'

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.75. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2025:3575 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes Security Fix(es): * buildah: Buildah allows arbitrary directory mount (CVE-2024-9675) * golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338) * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (CVE-2024-53197) * libxml2: Use-After-Free in libxml2 (CVE-2024-56171) * grub2: net: Out-of-bounds write in grub_net_search_config_file() (CVE-2025-0624) * libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2 (CVE-2025-24928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.4. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2025:2451 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.openshift.com/container-platform/4.18/release_notes/ocp-4-18-release-notes.html Security Fix(es): * buildah: Buildah allows arbitrary directory mount (CVE-2024-9675) * golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338) * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302) * mholt/archiver: path traversal vulnerability (CVE-2024-0406) * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) * distribution: Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT (CVE-2025-24976) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.18/updating/updating_a_cluster/updating-cluster-cli.html

Release of RHOAI 2.18.0 provides these changes:

Red Hat has issued a security advisory for a kernel update addressing two vulnerabilities in the Linux kernel. The first vulnerability (CVE-2024-50302) involves the HID core where the report buffer was not zero-initialized, potentially leading to security issues. The second vulnerability (CVE-2024-53197) affects the ALSA usb-audio driver, fixing potential out-of-bound accesses for Extigy and Mbox devices. These issues affect Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. The update requires a system reboot to take effect.

Red Hat released a security update for the kernel-rt packages, which provide the Real Time Linux Kernel for systems requiring high determinism. The update addresses two vulnerabilities: CVE-2024-50302, which fixes an issue in the HID core by zero-initializing the report buffer, and CVE-2024-53197, which fixes potential out-of-bound accesses in the ALSA usb-audio driver for Extigy and Mbox devices. The update is rated as Important by Red Hat and requires a system reboot to take effect.

Red Hat has issued a security advisory for multiple vulnerabilities in the Linux kernel packages included in Red Hat Enterprise Linux 8. These vulnerabilities include a zero-initialization issue in the HID core (CVE-2024-50302), potential out-of-bound accesses in ALSA usb-audio drivers (CVE-2024-53197), a potential deadlock in the megaraid_sas SCSI driver (CVE-2024-57807), and a use-after-free in the pps subsystem (CVE-2024-57979). The update addresses these issues and requires a system reboot to take effect. The advisory rates the security impact as Important (high severity).

Red Hat has issued a security advisory for kernel-rt packages in Red Hat Enterprise Linux 8, addressing multiple vulnerabilities including zero-initialization of HID report buffers, out-of-bound accesses in USB audio drivers, a potential deadlock in the megaraid_sas driver, and a use-after-free in the pps subsystem. These vulnerabilities affect the Real Time Linux Kernel used for systems requiring high determinism. The update is rated as Important by Red Hat Product Security and requires a system reboot after applying the patch.