RHSA-2024:10528HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.16.25 bug fix and security update

Published
December 4, 2024
Last Modified
November 5, 2026

🔗 CVE IDs covered (3)

CVE-2024-7409 →CVE-2024-10963 →CVE-2024-24968 →

📋 Description

CVE-2024-7409 — QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure CVE-2024-10963 — pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass CVE-2024-24968 — microcode_ctl: Denial of Service

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.16
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:046b11f6a94dcfa375bd9192dda6f386924396d72fa8fdad41528df61b0aaece_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:506697a755ecef999da1356a325518159a4d7d29b916a43f37875b2b9b88a279_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:5388e729f8516d0df2ef1134531d371070779c5ef0540e8be112d9e3cb667e5e_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:8053fd0a5ce78ebdab4f62e34a7df863a870ccb00fb1f7827bcc575cf6f88c1c_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:69db31e0e59a7b90ebf458d84d648a87bfa5e9d70a0c49190c67e83f8143f0b7_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:8bac6c045f8bf7fe33ecc37d4994930b3d95dbe5ba1e1f03f7f477dc444388b8_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:92e8ef6477fc75f778c6d9534489e5354116fd72e2fa3f16fe6eed2e23cf3f85_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:efa9859679e2702bba72eac08a45cbb289e33b3c94ebfd30d42ff65d24b22dbc_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/cloud-network-config-controller-rhel9@sha256:0a2431965d78648f69b8c8d3c1ff656c996494535c52da4e960cbf64eacb4905_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/cloud-network-config-controller-rhel9@sha256:557e09a865e14d44914e441fdb9f605ca70065adc8cb33d026298d2d2d3c820f_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/cloud-network-config-controller-rhel9@sha256:68085ff93404bf2fc3c5d0c53226478bf6874b5bc3efc337adf7e0c398c27e9a_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/cloud-network-config-controller-rhel9@sha256:b2fb919f59490b30b7386c4f645ac146bce931fd0f40c39d12495420fc75b579_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:0006408dc2300402a6a189a3e0536d7ceabf9077e1fb485325534b6bf908958b_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:3e0b156229a476a56c78fa9b6c4d3d3a5851b10f34054d2dc93247c2a14b1eda_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:88d3713b551abe6eb3dc229858ab17b57bfaa2fa2ee0ee65ed652e810d06a147_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:f652ebd881d3a3ba150f7d6a46aed720a2601d25a2ac595a2845cd638047011a_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:239162fcbe6c17068ec25c1ce354b65a4c3e7b67ba92c7cae081b6ad5cb9fea6_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:2f4ccff879666d4880d13f2b6fa586caecdb4d918153dd8432e5b475f98c2dcb_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:591faf39cc242fb1a049149a134157e629dc65c1fa64614b60ba0f7e2dd3a3d2_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:c9a05350dba0837287a53bf64962f1fba9e7e9046ab5d02eb86b3f10847017b8_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/egress-router-cni-rhel9@sha256:64889a4c94112243444660c1fd509fefd1f6b967865260f96669b632c7efee16_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/egress-router-cni-rhel9@sha256:69b06a1d5999558107881315791855f01e9db6c8db999f9795dfe04a4f2bfd47_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/egress-router-cni-rhel9@sha256:7a93320cd529c3bf6ee9986a1d76efa9806024fde7dce80cc886185e4f66b258_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/egress-router-cni-rhel9@sha256:ac1a5f43616aff71a32ea57709d181d9a47e57c46aa52ae5ff44637bcdd51bf2_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kube-metrics-server-rhel9@sha256:27edfd6920ce6f6b86f24a25805308b8d1c4d2c05a8913cc684832be919868d2_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kube-metrics-server-rhel9@sha256:31949ef5a68ce1cc91d8f2f832431430d7da6057995244405290b0a76acda1c1_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kube-metrics-server-rhel9@sha256:86747df01f646f0bff8bd473d5fda84febded81dabc51a2efc340f546fa7452a_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kube-metrics-server-rhel9@sha256:ba0227ed1c034e0c7997470d049827b4a69dd771ab16ced80e19751edf59891b_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kubevirt-csi-driver-rhel9@sha256:1b57bddf7447add1de1bbe555644d4f098788bfeeae79229de135c05b6165748_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:6be262c95acd928771f39e50afc7f1a628d5e20a2ba8c9a83a176c8eff809c06 (For s390x architecture) The image digest is sha256:d5fade25cc327a0f1b2174e9588ade616e4c240434e6a5e86088a2e5e9073431 (For ppc64le architecture) The image digest is sha256:8404b9ab00ca563e234145c0c7ab8f23600ad768639c5d28b56efec709db95eb (For aarch64 architecture) The image digest is sha256:284e30f29de4ca6220aadc4a691045d61b324308e51e3d5ddaf71d82bce8e816 All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To reduce the risk, administrators should ensure that no DNS hostname matches local TTY or service names used in pam_access. Additionally, implement DNSSEC to prevent spoofing of DNS responses. For stronger protection, consider reconfiguring pam_access to only accept fully qualified domain names (FQDNs) in access.conf

🔗 References (15)