RHBA-2024:11556 - Bug Fix Advisory

Topic

The JBoss Web Server (JWS) Operator for OpenShift has been updated to provide a fix for pam CVE-2024-10041 and CVE-2024-10963.

Description

This erratum covers updates to the JWS Operator for OpenShift to fix pam CVE-2024-10041 and CVE-2024-10963.

Solution

You can download the RHEL-8-based Middleware Containers container image that this update provides from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available in the Red Hat Container Catalog (see the References section).

Dockerfiles and scripts should be amended to refer to this new image specifically or to the latest image generally.

Affected Products

• Red Hat OpenShift Container Platform 4.12 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.11 for RHEL 8 x86_64

Fixes

• BZ - 2321440 - CVE-2024-9287 python: Virtual environment (venv) activation scripts don't quote paths
• BZ - 2325776 - CVE-2024-11168 python: Improper validation of IPv6 and IPvFuture addresses

CVEs

• CVE-2024-9287
• CVE-2024-10041
• CVE-2024-10963
• CVE-2024-11168

References

• https://access.redhat.com/errata/RHSA-2024:10779
• https://access.redhat.com/errata/RHSA-2024:10379