RHBA-2024:5039HighCVSS 8.8

Red Hat Bug Fix Advisory: Red Hat Quay v3.12.1 bug fix release

Published
August 19, 2024
Last Modified
October 14, 2026

🔗 CVE IDs covered (2)

CVE-2024-6345 →CVE-2024-36039 →

📋 Description

CVE-2024-6345 — pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools CVE-2024-36039 — python-pymysql: SQL injection if used with untrusted JSON input

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:577458b6392e6519d032b389935665d7d198d3561db24074910f256c1fe4e3f1_amd64 as a component of Quay v3
  • quay/clair-rhel8@sha256:85afe4b0a4aa4d6d5b185fdfcf0b4ac3c999fa5318be5738239be16990897fe4_s390x as a component of Quay v3
  • quay/clair-rhel8@sha256:c512daee0b7f2fafe4d1124ecdd9fc6bb7a04619a77ebb3d64b2e0fcb51062e1_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:53e3ef86d08fb4947c945ceca7392b3e757cd988211d54cfc4d4b5372befef1b_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:cf0302d8cadde95626abab8491962e26f1a31d420721cad590f7845bdbfbb081_s390x as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:e365dff96148af07cd95571f7aef49cb57068b53bb8e59921388889b0b3b97e5_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:05ca3d6fd58aac396387197cc1794fe6a1500a5429964c56b23f5ef536b6ffad_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:39243d53e33c55974ac3b070062c572039a4611ced2ba7a3f22b0919b04947a4_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:96acd07bb43a0fe21dd788a815e0830feeee5aea434ee97288eb14da38aff034_s390x as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:6c5657557b1bde88e466b072537cc2c35513cd6cfb35d20343175454c0eef38a_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:ae2b191f53bb9d87a66e609bd71cf7b264e3448d6097871bc590773b4c3ca557_s390x as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:c313b557b75742723228e84b1f25f1fe8bb234fa0b60abec5448ea0527e04076_ppc64le as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:18c7892e3091256b522749debca64e60bc62998513d617bf1e8f5baa11092a9e_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:535ca1e61bbbd33b58569f2cc38eb506641d277702ba4dd230a5093003c25718_ppc64le as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:53e16de2dcff319c47d54bcbfb4612f4b6e071ca7e513a0571950ddbf4ce46a3_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:296a79bbfcc7d237a750bb3ba3d141a2e78ccda45a37da8cce668926a6d76a19_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:39452abef3641134972d119b67e30738efb89e96c30e6c8f98bce66ede4be03b_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:cf7ca3537545ad9f71adf2d58e9037d947b5c307fb0a3aaf7196b05c00a8004b_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:23add71ac3591aedd2d4f868dd7fd3a9bf19667696750f82cb2479c5dc8d39d1_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:56fb1b958bdaa12f4b4dd4940f4fa75a44516e3e34cda47c3f03657c12afae03_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:dba9ef1a15d269fd3a76483581ded14b52ca01190ad0a6591da9b2e4049baa5b_amd64 as a component of Quay v3
  • quay/quay-operator-bundle@sha256:0b91cd4ec1a8344d3870eb2d7d7ee7a330f8024455e79f415f0fe533b0755994_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:9607e4d2493623608d8c7b578ff65cbece8e0b7f609b82f22858f9e313f4face_amd64 as a component of Quay v3
  • quay/quay-operator-bundle@sha256:b159f3721ce70c1fa11fa827cd3efa217e43d2ca57ac44838d3f445840461aef_s390x as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:18004300f6c50d85c678ea97cfea1df36a9c075006b886c978c08ea611347e78_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:919422f820a70dca69a1918ea1f5540f04e524f1ba3620a04393f67ae3922369_s390x as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:f577d16f91f542b6c1613e11c602a85e9ed5a7e21e59264e7fbadef4627721f0_ppc64le as a component of Quay v3
  • quay/quay-rhel8@sha256:1bb2235e8cc42e18d9406c509272ba668b9761bd1a62bd87827c75dc07d6d217_amd64 as a component of Quay v3
  • quay/quay-rhel8@sha256:4d72bf803cac450d16eff48bb0e48cacef77977f83560f274982e2a62a5aa7ab_s390x as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Make sure the permissions are set correctly for each user, database, table, operation, etc. Do not expose the PyMySQL library to untrusted JSON input.

🔗 References (11)