Headline
Red Hat Security Advisory 2024-7237-03
Red Hat Security Advisory 2024-7237-03 - Logging for Red Hat OpenShift - 5.8.13.
The following advisory data is extracted from:
https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_7237.json
Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat’s archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.
- Packet Storm Staff
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Logging for Red Hat OpenShift - 5.8.13
Advisory ID: RHSA-2024:7237-03
Product: logging for Red Hat OpenShift
Advisory URL: https://access.redhat.com/errata/RHSA-2024:7237
Issue date: 2024-09-26
Revision: 03
CVE Names: CVE-2024-6104
====================================================================
Summary:
Logging for Red Hat OpenShift - 5.8.13
Description:
Logging for Red Hat OpenShift - 5.8.13
Solution:
https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
https://docs.openshift.com/container-platform/4.13/logging/cluster-logging-upgrading.html
CVEs:
CVE-2024-6104
References:
https://access.redhat.com/security/updates/classification/#moderate
https://issues.redhat.com/browse/LOG-5210
https://issues.redhat.com/browse/LOG-5966
https://issues.redhat.com/browse/LOG-6103
https://issues.redhat.com/browse/LOG-6127
https://issues.redhat.com/browse/LOG-6134
Related news
Red Hat Security Advisory 2024-6811-03 - Red Hat OpenShift Container Platform release 4.13.51 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.
Red Hat Security Advisory 2024-5446-03 - Red Hat OpenShift Container Platform release 4.13.48 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a memory exhaustion vulnerability.
Red Hat Security Advisory 2024-5444-03 - Red Hat OpenShift Container Platform release 4.13.48 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include code execution and memory exhaustion vulnerabilities.
Red Hat Security Advisory 2024-5160-03 - Red Hat OpenShift Container Platform release 4.15.27 is now available with updates to packages and images that fix several bugs and add enhancements.
Red Hat Security Advisory 2024-5194-03 - An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Issues addressed include deserialization and memory exhaustion vulnerabilities.
Red Hat Security Advisory 2024-4858-03 - Red Hat OpenShift Container Platform release 4.16.5 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include deserialization and memory exhaustion vulnerabilities.
Red Hat Security Advisory 2024-4846-03 - Red Hat OpenShift Container Platform release 4.13.46 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.
Red Hat Security Advisory 2024-4321-03 - Red Hat OpenShift Container Platform release 4.15.21 is now available with updates to packages and images that fix several bugs and add enhancements.
Red Hat Security Advisory 2024-4316-03 - Red Hat OpenShift Container Platform release 4.16.2 is now available with updates to packages and images that fix several bugs and add enhancements.
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.