RHSA-2024:4872: Moderate: Release of OpenShift Serverless 1.33.1 security update
Version 1.33.1 of the OpenShift Serverless Operator is supported on Red HatOpenShift Container Platform versions 4.12, 4.13, 4.14, 4.15 and 4.16This release includes security, bug fixes, and enhancements.Security Fix(es): golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789) golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790) go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104) golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788) For more details about the security issues, including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE pages listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What specific vulnerabilities are addressed in RHSA-2024:4872?
RHSA-2024:4872 addresses security vulnerabilities related to incorrect handling in golang's archive/zip package.
What versions of OpenShift Serverless Operator are impacted by RHSA-2024:4872?
RHSA-2024:4872 impacts OpenShift Serverless Operator version 1.33.1.
Which OpenShift Container Platform versions are supported by the fix in RHSA-2024:4872?
The fix in RHSA-2024:4872 supports OpenShift Container Platform versions 4.12 through 4.16.
How can I update my OpenShift Serverless Operator to comply with RHSA-2024:4872?
You can update your OpenShift Serverless Operator to version 1.33.1 to comply with RHSA-2024:4872.
Is RHSA-2024:4872 critical for my security posture?
Yes, applying RHSA-2024:4872 is critical as it addresses security vulnerabilities that could affect the integrity of your system.