RHSA-2024:4028 - Security Advisory

Topic

Red Hat OpenShift Serverless version 1.33.0 is now available.

Red Hat Product Security has rated this update as having a security impact of
Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Description

Version 1.33.0 of the OpenShift Serverless Operator is supported on Red Hat
OpenShift Container Platform versions 4.12, 4.13, 4.14, 4.15 and 4.16

This release includes security, bug fixes, and enhancements.

Security Fix(es):

• golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
• golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
• quarkus-core: Leak of local configuration properties into Quarkus applications (CVE-2024-2700)
• netty-codec-http: Allocation of Resources Without Limits or Throttling (CVE-2024-29025)
• golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)
• golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)
• golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)
• jose-go: improper handling of highly compressed data (CVE-2024-28180)

For more details about the security issues, including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE pages listed in the References section.

Solution

See the Red Hat OpenShift serverless 1.33 documentation at:
https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1.33

Affected Products

• Red Hat Openshift Serverless 1 for RHEL 8 x86_64
• Red Hat OpenShift Serverless for IBM Power, little endian 1 for RHEL 8 ppc64le
• Red Hat OpenShift Serverless for IBM Z and LinuxONE 1 for RHEL 8 s390x
• Red Hat Openshift Serverless for ARM 1 for RHEL 8 aarch64

Fixes

• BZ - 2268018 - CVE-2023-45289 golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect
• BZ - 2268019 - CVE-2024-24783 golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm
• BZ - 2268021 - CVE-2024-24784 golang: net/mail: comments in display names are incorrectly handled
• BZ - 2268022 - CVE-2024-24785 golang: html/template: errors returned from MarshalJSON methods may break template escaping
• BZ - 2268046 - CVE-2024-24786 golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
• BZ - 2268854 - CVE-2024-28180 jose-go: improper handling of highly compressed data
• BZ - 2272907 - CVE-2024-29025 netty-codec-http: Allocation of Resources Without Limits or Throttling
• BZ - 2273281 - CVE-2024-2700 quarkus-core: Leak of local configuration properties into Quarkus applications
• BZ - 2277864 - Release of OpenShift Serverless Eventing 1.33.0
• BZ - 2277865 - Release of OpenShift Serverless Serving 1.33.0

CVEs

• CVE-2021-43618
• CVE-2023-6004
• CVE-2023-6597
• CVE-2023-6918
• CVE-2023-7008
• CVE-2023-45289
• CVE-2024-0450
• CVE-2024-2700
• CVE-2024-24783
• CVE-2024-24784
• CVE-2024-24785
• CVE-2024-24786
• CVE-2024-25062
• CVE-2024-26458
• CVE-2024-26461
• CVE-2024-28180
• CVE-2024-28834
• CVE-2024-29025
• CVE-2024-33599
• CVE-2024-33600
• CVE-2024-33601
• CVE-2024-33602

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1.33