(RHSA-2024:4144) Moderate: VolSync 0.9.2 for RHEL 9

2024-06-2619:03:28

access.redhat.com

volsync

kubernetes

asynchronous replication

rhel 9

security fix

cve-2024-24786

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.3

Confidence

Low

JSON

VolSync v0.9.2 is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters. After deploying
the VolSync operator, you can create and maintain copies of your persistent
data.

For more information about VolSync, see:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.10/html/business_continuity/business-cont-overview#volsync

or the VolSync open source community website at:
https://volsync.readthedocs.io/en/stable/.

This advisory contains enhancements and updates to the VolSync
container images.

Security fix(es):

CVE-2024-24786 - golang-protobuf: encoding/protojson,
internal/encoding/json: infinite loop in protojson.Unmarshal when
unmarshaling certain forms of invalid JSON