RHSA-2024:7179MediumCVSS 4.3

Red Hat Security Advisory: OpenShift Container Platform 4.15.35 bug fix and security update

Published
October 2, 2024
Last Modified
August 2, 2026

🔗 CVE IDs covered (1)

CVE-2024-28180 →

📋 Description

CVE-2024-28180 — jose-go: improper handling of highly compressed data

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:793dcc00947c42b49731957a33665c035749eb85401b88c10e1e70ce09bef615_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:ca9ec368406a4d9322fa6b62b535d706e35e848bfd9386fdeb9e48bab4872eeb_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:de090e0f3459d5ddeba646c8da369df005c936e928771f3439f3803d2e607d0b_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:e5a80bce602bcda2d1106551796eccba84c63f6234c93d815c4f017cb2188957_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:252b56cf7c167b8409b739c5d93cc6002e696559704c34da57dfecc3ba6f660f_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:815ba8b140648abd22bfab3f5856314e76291969be2e15a2bcef5869c524dacb_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:bf5e96588cb6abcea4011178ca3ab5e535fb809e9efe123abaa9b3e91d6579c5_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:eea9c474167de392d65cb13bf1e4ee9262758b55a815075a474b3eeb449308fb_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:629fdcf4b2d497a0656bc1ffe8a321c4171021c2b125b4dc18363563ed8debf1_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:b4b0ec374f9aa9029882874f08e87caa4463707b8c8b93cf51fc269ab13ab200_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:c84f6ccb5d603079532b3ce186f668ce6c98dd46bbaaee2b5a65e194292fa807_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:f4fe600907dae9966a7720ed921f955a2ae232cb438f217355de524070e42fdc_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:479d79ccf9be199af5c908106d420f752d4337990eae0b311dd5e088305559ba_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:54697d0e92c2b98b5f07ca906af9917bcc996aff20aaa2317d30db785bc43eb9_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:7f191194d92032c6159255b6e22f401eb6e75f0b182eea83a64d57ad45b42a71_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:ea2b8922bbf26e601d23faffa56235ef7bfaa7f8a10baf8e4988f74b0c632392_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:660e32b580406bb532cff9e155c1bf951a978e4eb1860bc3e6e8ad3b9b712e5a_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:840d800d2f43a57fc7561f40fbc1996cbf9c6904bc59b420cb93010b90e6455d_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:9d60e4cf42e0bdc0e9ee96ed8436ec02123380fe85045ad6fb3701d7459d01f1_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:c89e2a2ce7d8d87b07e0fa013e19c78b9ca1058212cceb31f8ab2fe16bf49c37_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:847d1fea22bf247a232dff71202d6b2fc03bc17e97e9d7a0889b21f879c9b23d_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:9b1dd10fdd3ec4595cebaacb53cf6485136be61ea017d07c14b190150df8e7e0_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:c73adc42a7617df67a3615a675fa3d357c1c2ec553b6ce2c289cca609c68df74_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:f0dc179e6090c7f5b3a9c3c9489259995350653ea9413f20b472fb95a9d2bb12_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:047d2b0b17cbdb0411ad08326ae16d54f554e04272f55d4cd44a733075695e7e_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:0a204f86b17ce8653180e2fe70ed594aee90fb8994f4a288968798c9dad5c139_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:1becca2bef012ed07253d4437568bcebf0c9fea883da46057fbc7106eafcff32_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:44dd4327c675484455d5314e23a9b79397ec1aecc239e1bd943009d7b26373e7_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/openshift-route-controller-manager-rhel8@sha256:439f70c3ae228ad576a48f6286af85b517592e9b6d6345d2d1e49e59e70433e1_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:8c8433f95d09b051e156ff638f4ccc95543918c3aed92b8c09552a8977a2a1a2 (For s390x architecture) The image digest is sha256:488e495ba97cf71e1eae882e48a5a69e4a9e064501cd851d277a5bae1e4c9dce (For ppc64le architecture) The image digest is sha256:aaf1874c8840256a65a7ba2e6f3ea993fe7bc2ebd9fb1ef266d64a06962b86cf (For aarch64 architecture) The image digest is sha256:eec1af68ae720806ec7d53d329a5737f61c8a5a5e85aeefa053edce1264685f6 All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (17)