Issued:

2024-09-03

Updated:

2024-09-03

RHSA-2024:6221 - Critical: The Red Hat OpenShift Builds 1.1.0 General Availability

Synopsis

Critical: The Red Hat OpenShift Builds 1.1.0 General Availability

Type/Severity

Security Advisory Critical

Topic

Red Hat OpenShift Builds 1.1.0 Critical: Security fixes and ships the operator with a RHEL9 base.

Description

The release of Red Hat OpenShift Builds 1.1.0 General Availability introduces the following change:

• The Builds Operator has been migrated to a RHEL 9 base.
• The CSI driver is now integrated and shipped with the operator.

Security fixes:

• openshift-builds-controller-container: go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients (CVE-2023-49569)

• openshift-builds-operator-container: golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)

• openshift-builds-waiters-container: golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

• openshift-builds-waiters-container: golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)

• openshift-builds-waiters-container: golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)

• openshift-builds-waiters-container: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

• openshift-builds-operator-container: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)

For more details about these security issues, including their impact, CVSS scores, acknowledgments, and other related information, refer to the CVE page listed in the References section.

Solution

Red Hat OpenShift Builds Release

Affected Products

Fixes

• This content is not included.BZ - 2258143
• This content is not included.BZ - 2268017
• This content is not included.BZ - 2268019
• This content is not included.BZ - 2268022
• This content is not included.BZ - 2268046
• This content is not included.BZ - 2268273
• This content is not included.BZ - 2279814
• This content is not included.BUILD-993

CVEs

• CVE-2023-45288
• CVE-2023-45290
• CVE-2023-49569
• CVE-2024-24783
• CVE-2024-24785
• CVE-2024-24786
• CVE-2024-24788

References

• https://access.redhat.com/security/updates/classification/#critical

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.