Issued:

2024-08-19

Updated:

2024-08-19

RHSA-2024:5547 - Important: Red Hat OpenShift Data Foundation 4.16.1 bug fix and security update

Synopsis

Important: Red Hat OpenShift Data Foundation 4.16.1 bug fix and security update

Type/Severity

Security Advisory Important

Topic

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.16.1 on Red Hat Enterprise Linux 9 from Red Hat Container Registry.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multi-cloud data management service with an S3-compatible API.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)
• go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)
• nodejs-ws: denial of service when handling a request with many HTTP headers (CVE-2024-37890)

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Fixes

• This content is not included.BZ - 2231151
• This content is not included.BZ - 2274165
• This content is not included.BZ - 2279814
• This content is not included.BZ - 2292777
• This content is not included.BZ - 2292787
• This content is not included.BZ - 2294000
• This content is not included.BZ - 2294407
• This content is not included.BZ - 2297946
• This content is not included.BZ - 2298656
• This content is not included.BZ - 2298718
• This content is not included.BZ - 2299443
• This content is not included.BZ - 2301880
• This content is not included.BZ - 2302238
• This content is not included.BZ - 2303080

CVEs

• CVE-2024-4032
• CVE-2024-6104
• CVE-2024-6409
• CVE-2024-24788
• CVE-2024-24790
• CVE-2024-24806
• CVE-2024-37890

References

• https://access.redhat.com/security/updates/classification/#important

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.