RHEA-2024:4022HighCVSS 7.5

Red Hat Enhancement Advisory: Red Hat OpenShift Pipelines Client tkn for 1.15.0 release

Published
June 20, 2024
Last Modified
September 18, 2026

🔗 CVE IDs covered (5)

CVE-2023-45288 →CVE-2024-28110 →CVE-2024-28180 →CVE-2024-29902 →CVE-2024-29903 →

📋 Description

CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2024-28110 — cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials CVE-2024-28180 — jose-go: improper handling of highly compressed data CVE-2024-29902 — cosign: Malicious attachments can cause system-wide denial of service CVE-2024-29903 — cosign: Malicious artifects can cause machine-wide denial of service

🎯 Affected products10

  • OpenShift Pipelines version 1.15 for RHEL 8
  • openshift-pipelines-client-0:1.15.0-11496.el8.aarch64 as a component of OpenShift Pipelines version 1.15 for RHEL 8
  • openshift-pipelines-client-0:1.15.0-11496.el8.ppc64le as a component of OpenShift Pipelines version 1.15 for RHEL 8
  • openshift-pipelines-client-0:1.15.0-11496.el8.s390x as a component of OpenShift Pipelines version 1.15 for RHEL 8
  • openshift-pipelines-client-0:1.15.0-11496.el8.src as a component of OpenShift Pipelines version 1.15 for RHEL 8
  • openshift-pipelines-client-0:1.15.0-11496.el8.x86_64 as a component of OpenShift Pipelines version 1.15 for RHEL 8
  • openshift-pipelines-client-redistributable-0:1.15.0-11496.el8.aarch64 as a component of OpenShift Pipelines version 1.15 for RHEL 8
  • openshift-pipelines-client-redistributable-0:1.15.0-11496.el8.ppc64le as a component of OpenShift Pipelines version 1.15 for RHEL 8
  • openshift-pipelines-client-redistributable-0:1.15.0-11496.el8.s390x as a component of OpenShift Pipelines version 1.15 for RHEL 8
  • openshift-pipelines-client-redistributable-0:1.15.0-11496.el8.x86_64 as a component of OpenShift Pipelines version 1.15 for RHEL 8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (4)