(RHSA-2024:3617) Moderate: Kube Descheduler Operator for Red Hat OpenShift 5.0.1 for RHEL 9

2024-07-0100:51:39

access.redhat.com

kube descheduler

red hat openshift

evicting pods

golang security fixes

rhel 9

cve-2024-24785

cve-2024-24784

cve-2024-24783

cve-2024-24786

cve-2023-45290

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

6.7

Confidence

Low

JSON

The Kube Descheduler Operator for Red Hat OpenShift is an optional
operator that deploys the descheduler, which is responsible for
evicting pods based on certain strategies.

Security Fix(es):

golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)
golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)
golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)