RHSA-2024:4474HighCVSS 8.1

Red Hat Security Advisory: OpenShift Container Platform 4.15.22 security update

Published
July 18, 2024
Last Modified
November 6, 2026

🔗 CVE IDs covered (1)

CVE-2024-6387 →

📋 Description

CVE-2024-6387 — openssh: regreSSHion - race condition in SSH allows RCE/DoS

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:29f230e2905fb8bbc2fa6c282d611f07e3da8ff81bf26cc9970ccba4aa308db5_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:8cfb6ef2c1a43d671c7a29ceb27e73e936834359721e7a8a489093a213d253c4_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:94c4beb741d5fb300ed5414efaeac93c491f8db39d2cb6f71fe7544ace1ab5ec_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:b200c7f0b872cfbb29a7d49094915b3673287bb2dd1f9fa05a39c99399e38683_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:07440eae6c4544ab7f61320403df91f51dd5ed5d8d57e69454dd27ad697e525d_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:2dde3a9ee794e39551c6a8de4659ca05b35e49ebb15e477d422dd7982219bb2c_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:ceeb6030f7a0f2d972a268b27538f5fe703ca55fc3a01fb70c1616c705666b6f_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:d8f9ce2bc8d105d3cea698652951cd5d01fcf573a16e67565c08f204d9ee7d6f_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:2c945870a60f32cded8f1714fda36111ab77eaaa76b319719d61a874cf72a40f_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:e574e7396a15fade349c8a56625fdebd77d60249ab04a1dcffbedf5097cd895a_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:f2c895e0a9025e9327c4772658949b37a86d1ac363e489396d5737f4e2a2b4fd_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:f99247c90a2304a9dc5d89a423571f608a0fb0a0d673bf1242290a95e784f018_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:390f1f90a210cb507d8b15cb39ed0ab9a07ad0e8d8121972476c7e7199a06f41_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:5771127e88a97feabe24beb21a2e613810aed7286d455de1f913fc53bc8cb7f9_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:703d0c8ca03b781e55ba100adaa653e2330b031a7ebba40cfcb8dba29b6a074c_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:70de36d4fd709779a2722c53846454cb24cb6f1228a76534c5e7d88e33987ffe_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:3185818e627d7f10442c94ca73717fbdf1e7cd5afb8b51f8213d88b5743e1c57_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:6f31a194177c8f3d7955dda8be2043ad2a896f820f654ed1cb82f5f628e9aeef_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:b072fc885d6961b8dfa0e45d5800ba48cd77bed98a504aef4112b5e8fa98280a_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:bc2f9bcb65dd8fd8aee66d6a5eeb35acc452e38b9174a25d6455119ed600a685_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:111bd171372b1bf5b9db33930629a21f04584633c4b94cebf724ea5a16cbb381_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:29f8cc2b4d693bfef74b2f53e630a656384adc44b704ce49066e8bf39459aeb6_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:95b57f5bca50fc77f6a0bdc89a96fb1938e65eaf886a177bde9c3f536a4478f7_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:a84c0778dde1ad8164fd83ed480b7dfdaaec5f1b6c681b50866d76ec7850e3c3_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-alibaba-cloud-controller-manager-rhel9@sha256:2a4f6b0d4831da2bf2761941c29dee2fe0ef59684ec7db971f25f4c0750ddd15_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-alibaba-cloud-csi-driver-container-rhel9@sha256:71ea9c4fafad2ca680d3e3f405e03f3912df9e70155177fd63ac24b6ec783444_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-alibaba-machine-controllers-rhel9@sha256:e2f1d30c6d33af0ed57a6b0050f51d0866e92f2f6ef148dee55e6745f7a6d9a2_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:1dd8404a5b1a03125c2ec7c3c9f119b6f39d0ba4182f96324bb0d95184ef28f6_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-apiserver-network-proxy-rhel9@sha256:a1c40ffe1394c55bcd6505837c951f7610ebca89bf7d02d2184fdd4ec804f1b5_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:f0787207e687538a2d1248f2956b5bd26e304334eeb2f6474833040063377e9a (For s390x architecture) The image digest is sha256:483f95c386a24778ea807286fac3a1b702787893a265305dfd6af13f0cf85645 (For ppc64le architecture) The image digest is sha256:27b5b20aa2f76345c7fedc4cea350a3fa37f055472a260d7c971a1bb62dbd2b0 (For aarch64 architecture) The image digest is sha256:b24c0158d257fdf06277d68656c29c8ec3abdea2905801a721f606a024568c8f All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html Workaround: The below process can protect against a Remote Code Execution attack by disabling the LoginGraceTime parameter on Red Hat Enterprise Linux 9. However, the sshd server is still vulnerable to a Denial of Service if an attacker exhausts all the connections. 1) As root user, open the /etc/ssh/sshd_config 2) Add or edit the parameter configuration: ~~~ LoginGraceTime 0 ~~~ 3) Save and close the file 4) Restart the sshd daemon: ~~~ systemctl restart sshd.service ~~~ Setting LoginGraceTime to 0 disables the SSHD server's ability to drop connections if authentication is not completed within the specified timeout. If this mitigation is implemented, it is highly recommended to use a tool like 'fail2ban' alongside a firewall to monitor log files and manage connections appropriately. If any of the mitigations mentioned above is used, please note that the removal of LoginGraceTime parameter from sshd_config is not automatic when the updated package is installed.

🔗 References (19)