RHSA-2024:5547 - Security Advisory

Topic

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.16.1 on Red Hat Enterprise Linux 9 from Red Hat Container Registry.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multi-cloud data management service with an S3-compatible API.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)
• go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)
• nodejs-ws: denial of service when handling a request with many HTTP headers (CVE-2024-37890)

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Data Foundation 4 for RHEL 9 x86_64
• Red Hat OpenShift Data Foundation for IBM Power, little endian 4 for RHEL 9 ppc64le
• Red Hat OpenShift Data Foundation for IBM Z and LinuxONE 4 for RHEL 9 s390x
• Red Hat OpenShift Data Foundation for RHEL 9 ARM 4 aarch64

Fixes

• BZ - 2231151 - [perf] nfs-ganesha container OOM killed during perf testing
• BZ - 2274165 - [Tracker for https://bugzilla.redhat.com/show_bug.cgi?id=2292372] [GSS] ODF 4.14 Ceph MGR crashing after installation ImportError: Module not found
• BZ - 2279814 - CVE-2024-24788 golang: net: malformed DNS message can cause infinite loop
• BZ - 2292777 - CVE-2024-37890 nodejs-ws: denial of service when handling a request with many HTTP headers
• BZ - 2292787 - CVE-2024-24790 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
• BZ - 2294000 - CVE-2024-6104 go-retryablehttp: url might write sensitive information to log file
• BZ - 2294407 - consume ibm-storage-odf-operator.v1.5.0 instead of ibm-storage-odf-operator.v1.4.1
• BZ - 2297946 - update console API from v1alpha1 to v1
• BZ - 2298656 - [Critical] Upgrade ceph version to RHCEPH-7.1z1 at ODF-4.16.1
• BZ - 2298718 - [cloned] update console API from v1alpha1 to v1
• BZ - 2299443 - OCS client operator running in non - provider mode need to be disabled
• BZ - 2301880 - ocs-operator should export info that it is running in provider mode
• BZ - 2302238 - Enable upgrade from 4.15 to 4.16.1
• BZ - 2303080 - The default cephblockpool, cephfilesystem and cephobjectstore.rgw pools are created with a single PGs (pg_num 1 pgp_num 1)

CVEs

• CVE-2024-4032
• CVE-2024-6104
• CVE-2024-6409
• CVE-2024-24788
• CVE-2024-24790
• CVE-2024-24806
• CVE-2024-37890

References

• https://access.redhat.com/security/updates/classification/#important