RHSA-2024:1697: Important: Errata Advisory for Red Hat OpenShift GitOps v1.11.3 security update
Errata Advisory for Red Hat OpenShift GitOps v1.11.3.<br>Security Fix(es):<br><li> argo-cd: Denial of Service Due to Unsafe Array Modification in Multi-threaded</li> Environment (CVE-2024-21661)<br><li> argo-cd: Users with create but not override privileges can perform local</li> sync (CVE-2023-50726)<br><li> argo-cd: Bypassing Brute Force Protection via Application Crash and In-Memory</li> Data Loss (CVE-2024-21652)<br><li> argo-cd: uncontrolled resource consumption vulnerability (CVE-2024-29893)</li> <li> argo-cd: Bypassing Rate Limit and Brute Force Protection Using Cache Overflow</li> (CVE-2024-21662)<br>For more details about the security issue(s), including the impact, a CVSS<br>score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Other sources
Important: Errata Advisory for Red Hat OpenShift GitOps v1.11.3 security update
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2024:1697?
The severity of RHSA-2024:1697 is categorized as high due to the denial of service vulnerability in the affected version.
How do I fix RHSA-2024:1697?
To fix RHSA-2024:1697, upgrade to the latest version of Red Hat OpenShift GitOps that addresses the vulnerabilities.
What vulnerabilities are addressed in RHSA-2024:1697?
RHSA-2024:1697 addresses a denial of service vulnerability due to unsafe array modification in multi-threaded environments, specifically CVE-2024-21661.
Which products are affected by RHSA-2024:1697?
The products affected by RHSA-2024:1697 include Red Hat OpenShift GitOps for ARM 64, IBM Power, IBM Z and LinuxONE, and the standard Red Hat OpenShift GitOps.
Who can exploit the vulnerabilities in RHSA-2024:1697?
Users with 'create' but not 'override' privileges can exploit the vulnerabilities outlined in RHSA-2024:1697.