Lucene search

RedHatRHSA-2024:1333

HistoryMar 14, 2024 - 3:03 p.m.

(RHSA-2024:1333) Moderate: Release of OpenShift Serverless 1.32.0

2024-03-1415:03:47

access.redhat.com

openshift serverless operator

security fixes

red hat openshift container platform

cve-2024-28110

cvss score

CVSS2

5.2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

Low

EPSS

0.965

Percentile

99.6%

JSON

Version 1.32.0 of the OpenShift Serverless Operator is supported on Red Hat
OpenShift Container Platform versions 4.12, 4.13 and 4.14

This release includes security, bug fixes, and enhancements.

Security Fix(es):

cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials (CVE-2024-28110)

For more details about the security issues, including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE pages listed in the References section.

CVSS2

5.2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

Low

EPSS

0.965

Percentile

99.6%

JSON

Related for RHSA-2024:1333