RHSA-2024:5094: Moderate: Red Hat OpenShift Service Mesh Containers for 2.6.0 security update
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.Security Fix(es): quic-go: memory exhaustion attack against QUIC's connection ID mechanism(CVE-2024-22189) moby: cert signing bypass(CVE-2018-12608) golang: archive/zip: Incorrect handling of certain ZIP files(CVE-2024-24789) jose: resource exhaustion(CVE-2024-28176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2024:5094?
The severity of RHSA-2024:5094 is classified as High due to the potential for memory exhaustion attacks.
What vulnerabilities are addressed in RHSA-2024:5094?
RHSA-2024:5094 addresses a memory exhaustion attack against QUIC's connection ID mechanism identified as CVE-2024-2218.
How do I fix RHSA-2024:5094?
To fix RHSA-2024:5094, users should upgrade to the patched version of Red Hat OpenShift Service Mesh as specified in the advisory.
Which software does RHSA-2024:5094 affect?
RHSA-2024:5094 affects Red Hat OpenShift Service Mesh, specifically versions that utilize the quic-go library.
Is RHSA-2024:5094 applicable to all versions of OpenShift Service Mesh?
RHSA-2024:5094 is not applicable to all versions; users should consult the advisory for specific version details.