First published: Tue May 28 2024(Updated: )
Errata Advisory for Red Hat OpenShift GitOps v1.12.3<br>Security Fix(es):<br><li> CVE-2024-31989 argocd: unprivileged pod in a different namespace on the same cluster could connect to the Redis server.</li> For more details about the security issue(s), including the impact, a CVSS<br>score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software | Affected Version | How to fix |
---|---|---|
Red Hat Red Hat OpenShift GitOps for IBM Power, little endian | ||
Red Hat Red Hat OpenShift GitOps for ARM 64 | ||
Red Hat Red Hat OpenShift GitOps for IBM Z and LinuxONE | ||
Red Hat Red Hat OpenShift GitOps |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of RHSA-2024:3368 is categorized as important due to the potential exposure of services to unprivileged pods in different namespaces.
To fix RHSA-2024:3368, upgrade to the patched version of Red Hat OpenShift GitOps as specified in the advisory.
RHSA-2024:3368 addresses CVE-2024-31989, which allows unprivileged pods to connect to the Redis server in different namespaces.
The affected products include Red Hat OpenShift GitOps and its versions for IBM Power, ARM 64, and IBM Z and LinuxONE.
Currently, there is no specific workaround for RHSA-2024:3368 other than applying the recommended upgrade.