RHSA-2024:6341 - Security Advisory

Topic

Kube Descheduler Operator for Red Hat OpenShift 5.1.0 for RHEL 9

Description

The Kube Descheduler Operator for Red Hat OpenShift is an optional
operator that deploys the descheduler, which is responsible for
evicting pods based on certain strategies.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)
• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

Affected Products

• Kube Descheduler Operator 5 x86_64

Fixes

• BZ - 2279814 - CVE-2024-24788 golang: net: malformed DNS message can cause infinite loop
• BZ - 2292787 - CVE-2024-24790 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
• BZ - 2295310 - CVE-2024-24791 net/http: Denial of service due to improper 100-continue handling in net/http
• OCPBUGS-41860 - Enabling thresholdPriority and thresholdPriorityClassName together it does not throw any error in the descheduler operator logs
• OCPBUGS-11891 - Descheduling OpenShift Virtualization VMs using LowNodeUtilization results in unstable behavior

CVEs

• CVE-2023-52425
• CVE-2024-2398
• CVE-2024-6232
• CVE-2024-6345
• CVE-2024-6923
• CVE-2024-24788
• CVE-2024-24790
• CVE-2024-24791
• CVE-2024-28757
• CVE-2024-37370
• CVE-2024-37371
• CVE-2024-37891

References

• https://access.redhat.com/security/updates/classification/#moderate