RHSA-2024:0040 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 4.16.0 is now available with
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container
Platform 4.16.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 4.16.0. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHSA-2024:0041

Security Fix(es):

• ssh: Prefix truncation attack on Binary Packet Protocol (BPP)

(CVE-2023-48795)

• golang-protobuf: encoding/protojson, internal/encoding/json: infinite

loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
(CVE-2024-24786)

• cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks

credentials (CVE-2024-28110)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

All OpenShift Container Platform 4.16 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Container Platform 4.16 for RHEL 9 x86_64
• Red Hat OpenShift Container Platform for Power 4.16 for RHEL 9 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.16 for RHEL 9 s390x
• Red Hat OpenShift Container Platform for ARM 64 4.16 for RHEL 9 aarch64

Fixes

• BZ - 2254210 - CVE-2023-48795 ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
• BZ - 2268046 - CVE-2024-24786 golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
• BZ - 2268372 - CVE-2024-28110 cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials
• OCPBUGS-24231 - OCP 4.15 sriov-network-config-daemon pod not pinned to mgmt cores when workload partitioning enabled
• OCPBUGS-24595 - Cloudeventproxy 2 Card WPC not able to handle multiple dependency and multiple ts2phcs
• OCPBUGS-24870 - Update 4.16 sriov-network-device-plugin-container image to be consistent with ART
• OCPBUGS-24951 - Update 4.16 node-feature-discovery-container image to be consistent with ART
• OCPBUGS-25430 - PTP event getCurrentState for GNSS return event not found
• OCPBUGS-24822 - Update 4.16 ib-sriov-cni-container image to be consistent with ART
• OCPBUGS-24869 - Update 4.16 sriov-network-operator-container image to be consistent with ART
• OCPBUGS-24882 - Update 4.16 sriov-dp-admission-controller-container image to be consistent with ART
• OCPBUGS-24901 - Update 4.16 sriov-network-webhook-container image to be consistent with ART
• OCPBUGS-24982 - Update 4.16 sriov-network-config-daemon-container image to be consistent with ART
• OCPBUGS-25010 - Update 4.16 sriov-cni-container image to be consistent with ART
• OCPBUGS-25031 - Mustgather to rhel9
• OCPBUGS-25568 - Update 4.16 cloud-event-proxy-container image to be consistent with ART
• OCPBUGS-25853 - SR-IOV ci/prow/pkg job error
• OCPBUGS-24435 - [flake] cnf-tests: [It] [sriov] VRF integration Integration: SRIOV, IPAM: static, Interfaces: 1, Scheme: 2 Pods 2 VRFs OCP Primary network overlap {"IPStack":"ipv4"}
• OCPBUGS-24891 - Update 4.16 cluster-nfd-operator-container image to be consistent with ART
• OCPBUGS-27053 - nmea_status parsing throws nil pointer exception
• OCPBUGS-27197 - temp fix for NFD 4.15 in master
• OCPBUGS-27407 - Update 4.16 sriov-network-device-plugin image to be consistent with ART
• OCPBUGS-28215 - Adjust CSV version to 4.16
• OCPBUGS-27301 - PTP is sending FREERUN events with "event-not-found" resource when clock is locked
• OCPBUGS-28248 - sriov-network-operator test bug: not working on mellanox interfaces
• OCPBUGS-28715 - /lib host directory is not mapped into NFD worker
• OCPBUGS-29171 - Add NodeFeature CRD to deployment
• OCPBUGS-29692 - Master ServiceAccount needs to be updated
• OCPBUGS-25986 - sriov-cni - `GLIBC_2.32' not found while upgrading to 4.14
• OCPBUGS-30926 - SriovNetworkNodeState error "-E- Failed to open the device"
• OCPBUGS-31554 - SRIOV operator webhooks are not able to start with runningAsRoot: false
• OCPBUGS-31586 - Update Sr-IOV Owners
• OCPBUGS-32054 - PTP HAProfile with event enabled restarts due to concurrent write error
• OCPBUGS-32443 - Cloud-event-proxy and consumer processes on the consumer deployment side taking up isolated cores instead of reserved cores
• OCPBUGS-33186 - Sriov network operator pod is crashing due to panic: runtime error: invalid memory address or nil pointer dereference
• OCPBUGS-31362 - SRIOV: Cluster was drained twice after applying SRIOV policy with the externally managed flag.
• OCPBUGS-32317 - SR-IOV: sriov-config daemon continues the configuration even if the node is still draining
• OCPBUGS-33988 - Installation of NFD 4.16 pre-release operator is failing on OCP on Power
• OCPBUGS-34582 - SR-IOV: Pings Failing Between Pods Due to Duplicate MAC Addresses on VFs

CVEs

• CVE-2023-48795
• CVE-2023-49569
• CVE-2023-52425
• CVE-2024-24786
• CVE-2024-25062
• CVE-2024-28110
• CVE-2024-28182
• CVE-2024-28757

References

• https://access.redhat.com/security/updates/classification/#critical