RHSA-2024:1477MediumCVSS 7.3

Red Hat Security Advisory: Red Hat OpenShift for Windows Containers 8.1.2 security update

Published
March 25, 2024
Last Modified
November 6, 2026

🔗 CVE IDs covered (5)

CVE-2023-7104 →CVE-2023-39615 →CVE-2021-35937 →CVE-2021-35938 →CVE-2021-35939 →

📋 Description

CVE-2021-35937 — rpm: TOCTOU race in checks for unsafe symlinks CVE-2021-35938 — rpm: races with chown/chmod/capabilities calls during installation CVE-2021-35939 — rpm: checks for unsafe symlinks are not performed for intermediary directories CVE-2023-7104 — sqlite: heap-buffer-overflow at sessionfuzz CVE-2023-39615 — libxml2: crafted xml can cause global buffer overflow

🎯 Affected products3

  • Red Hat OpenShift Container Platform 4.13
  • openshift4-wincw/windows-machine-config-operator-bundle@sha256:6ea9ef348bd1abe40df806876e083466f039041b33c3ca60078983384e7d2031_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4-wincw/windows-machine-config-rhel9-operator@sha256:f1faec08700a916dd603e8e50f335c07505cbace4e676326cd318c3f62b85e99_amd64 as a component of Red Hat OpenShift Container Platform 4.13

✅ Remediation

For Windows Machine Config Operator upgrades, see the following documentation: https://docs.openshift.com/container-platform/latest/windows_containers/windows-node-upgrades.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (9)