RHSA-2024:8981HighCVSS 8.0

Red Hat Security Advisory: OpenShift Container Platform 4.17.4 bug fix and security update

Published
November 13, 2024
Last Modified
November 1, 2026

🔗 CVE IDs covered (2)

CVE-2024-39338 →CVE-2024-47875 →

📋 Description

CVE-2024-39338 — axios: axios: Server-Side Request Forgery CVE-2024-47875 — dompurify: nesting-based mutation XSS vulnerability

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.17
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:0f79313c0ab346eb8522000fced85523e511e9db8d065aea4db90b5472cac6eb_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:3d6e47a52377e4f611e325a2af139bc417f82bf0aa4d6ef70820ab336093e1d2_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:5abdb729506a7e03803e09a084b7a259b670e888283c12d69b0955bde746646f_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:c5db7cdddf996d0927e31e72a7534404bdd0fff99c645bec0cb0407e929fd685_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:27f99fe0644c0edbfe26ffb9996cc97452ff8fdd6dc7b21c200e0b5fc5087190_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:3e7aa463e50cf73419e6910af7b12b848f33d1766eab422e557d4ed02a2f6aa1_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:4e28bde11bc8aa07e403db0b02abc17c07c0c9918923cbe52702069c5c410709_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:5fec7634d843a3ae6e6b42723ad82a05165e5ac2338408806e9b2e56be422666_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/cloud-network-config-controller-rhel9@sha256:2c54c630f027e36dadf6132cb520448ccbd16dfca439e47ab89734f3bb58aac7_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/cloud-network-config-controller-rhel9@sha256:b44d1142bc98fd9a229226498ae36712497f69795a8798ebc8c1b7445bff5ec1_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/cloud-network-config-controller-rhel9@sha256:be5baf7b8ee574f2f13d2d3cdbd3fe9e163de5bdf4ab71c83ae797a5283daeb4_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/cloud-network-config-controller-rhel9@sha256:d0635e2b8f6dd49e1f8b577cc6d7c3069480a0f5437bee7fcc2744fe178b2b28_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:45ee9c2521de43723922ebfbcf346d5de9a136f1e6bc72eb54b78d69d685531a_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:55c0c655f7cbfdb669a978af47524ecb757d309bc24ecbfa1011ef05680e7d85_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:5ad99684cf9160f7b3e8e4a292026a021adbe6a67fb8655c9b260e04b7c2d3cf_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:a02d5a21da44900b709e17831c15ce9bb567fdffaad51b508bfa8b7a401c2ad4_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:0eb32533eead3ff77f79a97be3a651a67a2b8bff4ec363ba4d44f9150848eb63_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:475a9c7e88ccc75f098d239dbb2164f37c2101e9d5cf1ac47bec6b8c736c79c2_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:5c12da5f4f92ea7d919401074592669f7705144f12b9d246d2d19611c718d7d9_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:d32e77d1ac790e382faced2a0b1276abaede7ad520233ac77ff4a3ca279e0b29_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/egress-router-cni-rhel9@sha256:732c2acfed1dd9eea7c51ff8df868e4cebc0248bd3d54a73e4b30d99c919b8bb_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/egress-router-cni-rhel9@sha256:8ded09863d25803cc633da061fd7c971f914f6d33e6a4573349714b10dafc2aa_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/egress-router-cni-rhel9@sha256:a3daff849818187f122e430d63294494c9ffec448f8ab029ba706d43db56ccaf_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/egress-router-cni-rhel9@sha256:ad8b1c59138a3bca79294f6b987527ff011ab450b55ab1063f974100f5840a0b_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:0c29c70517ea80eed7761fddd4cc44dea6472b960d47774115e34c8bacc06112_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:1505069d1fc98d3dbeb07975ca3ed11818834b5d82246f655b216b386cd6fd61_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:46f7e7547beb68bfa4a2300307bbb20f41b947d480f5bcaab881c9448856c23a_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:f9caf3f30c790a49b0e386b722b31124aeb016eceaacc80f41b33eaf9ebf4de3_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/kube-metrics-server-rhel9@sha256:069494d53a43ed323357c924814c3ba91947788b503b9017913fc4a0cd19e655_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:bada2d7626c8652e0fb68d3237195cb37f425e960347fbdd747beb17f671cf13 (For s390x architecture) The image digest is sha256:8c07c2547eb4e4a62ad5b5cad83610239cd54d1e54dabf3ddb80aead4fd6cc1c (For ppc64le architecture) The image digest is sha256:91ff74d74084e8334a1f7961b630ee6d9e10f3960674ceb496c9452132a4509e (For aarch64 architecture) The image digest is sha256:fcb6eb3e470aad9d4fb51e2ae564e295b823b88d0e9d92129ea7b8ed53d6fb4e All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (37)