RHSA-2024:1812: Moderate: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-376 Bug Fixes
Moderate: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-376 Bug Fixes
Other sources
The Custom Metrics Autoscaler Operator for Red Hat OpenShift is an optional operator, based on the Kubernetes Event Driven Autoscaler (KEDA), which allows workloads to be scaled using additional metrics sources other than pod metrics. This release builds upon updated compiler, runtime library, and base images for the purpose of resolving any potential security issues present in previous toolset versions.This version makes use of newer tools and libraries to address the following issues:golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)jose-go: improper handling of highly compressed data (CVE-2024-28180)opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics (CVE-2023-47108)In addition, the following bug has been fixed:Custom metrics operator memory leak when invalid scaledObject is defined (prometheus scaler)This release is based upon KEDA 2.12.1
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2024:1812?
The severity of RHSA-2024:1812 is classified as moderate.
How do I fix RHSA-2024:1812?
To fix RHSA-2024:1812, update to Custom Metrics Autoscaler Operator version 2.12.1-376 or later.
What products are affected by RHSA-2024:1812?
RHSA-2024:1812 affects the Custom Metric Autoscaler for Red Hat OpenShift.
What are the key features of Custom Metrics Autoscaler impacted by RHSA-2024:1812?
The Custom Metrics Autoscaler allows workloads in Red Hat OpenShift to be scaled based on additional metrics.
When was RHSA-2024:1812 issued?
RHSA-2024:1812 was issued to address bug fixes in the Custom Metrics Autoscaler for Red Hat OpenShift.