RHBA-2024:6716 - Bug Fix Advisory

Topic

This erratum covers updates to the current Red Hat JBoss Web Server 5.8 for OpenShift images to fix curl and python-setuptools CVEs.

Description

Red Hat xPaaS provides images for many of the Red Hat Middleware products that are available for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments.

The current JBoss Web Server 5.8 for OpenShift images have been updated to fix the following curl and python-setuptools CVEs:

• curl: CVE-2024-2398
• python-setuptools: CVE-2024-6345

Solution

To update to the latest JBoss Web Server 5.8.1 for OpenShift image on UBI8, perform the following steps to pull in the content:

1. On your master host(s), ensure that you are logged in to the command line interface as a cluster administrator or user who has project administrator access to the global "openshift" project:

$ oc login -u system:admin

2. Depending on the OpenJDK version, run one of the following commands to update the core JBoss Web Server 5.8 tomcat 9 OpenShift image stream in the "openshift" project:

• For OpenJDK 8:

To update the core JBoss Web Server 5.8 tomcat 9 with OpenJDK 8 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver58-openjdk8-tomcat9-openshift-ubi8:5.8.1

• For OpenJDK 11:

To update the core JBoss Web Server 5.8 tomcat 9 with OpenJDK 11 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver58-openjdk11-tomcat9-openshift-ubi8:5.8.1

• For OpenJDK 17:

To update the core JBoss Web Server 5.8 tomcat 9 with OpenJDK 17 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver58-openjdk17-tomcat9-openshift-ubi8:5.8.1

Affected Products

• Red Hat OpenShift Container Platform 4.12 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.11 for RHEL 8 x86_64

Fixes

• BZ - 2270498 - CVE-2024-2398 curl: HTTP/2 push headers memory-leak

CVEs

• CVE-2018-15209
• CVE-2023-6228
• CVE-2023-25433
• CVE-2023-52356
• CVE-2024-2398
• CVE-2024-6345
• CVE-2024-37370
• CVE-2024-37371
• CVE-2024-37891

References

• https://access.redhat.com/errata/RHSA-2024:5654
• https://access.redhat.com/errata/RHSA-2024:5530