(RHSA-2024:4872) Moderate: Release of OpenShift Serverless 1.33.1 security update

2024-07-2514:42:25

access.redhat.com

openshift serverless

security update

red hat

platform versions

cve

security fixes

cvss score

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

High

JSON

Version 1.33.1 of the OpenShift Serverless Operator is supported on Red Hat
OpenShift Container Platform versions 4.12, 4.13, 4.14, 4.15 and 4.16

This release includes security, bug fixes, and enhancements.

Security Fix(es):

golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)
golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)
go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)
golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

For more details about the security issues, including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE pages listed in the References section.