RHBA-2024:6717 - Bug Fix Advisory

Topic

The JBoss Web Server (JWS) Operator for OpenShift has been updated to provide a fix for python-setuptools and curl CVEs.

Description

This erratum covers updates to the JWS Operator for OpenShift to fix the following python-setuptools and curl CVEs:

• curl: CVE-2024-2398
• python-setuptools: CVE-2024-6345

Solution

You can download the RHEL-8-based Middleware Containers container image that this update provides from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available in the Red Hat Container Catalog (see the References section).

Dockerfiles and scripts should be amended to refer to this new image specifically or to the latest image generally.

Affected Products

• Red Hat OpenShift Container Platform 4.12 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.11 for RHEL 8 x86_64

Fixes

• BZ - 2270498 - CVE-2024-2398 curl: HTTP/2 push headers memory-leak

CVEs

• CVE-2023-2953
• CVE-2024-2398
• CVE-2024-3651
• CVE-2024-6345
• CVE-2024-25062
• CVE-2024-28182
• CVE-2024-37370
• CVE-2024-37371
• CVE-2024-37891

References

• https://access.redhat.com/errata/RHSA-2024:5654
• https://access.redhat.com/errata/RHSA-2024:5530