VDB
RHSA-2024%3A10857
RHSA-2024%3A10857
PUBLISHED
CVSS 7.5 HIGH
A memory exhaustion flaw was found in the otelgrpc handler of open-telemetry. This flaw may allow a remote unauthenticated attacker to flood the peer address and port and exhaust the server's memory by sending multiple malicious requests, affecting the availability of the system.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:dcae2122c156f0b2ec7bcfa3f75d86cb7dce2f71d7b7e4de80b5c859b5812cce_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:dcae2122c156f0b2ec7bcfa3f75d86cb7dce2f71d7b7e4de80b5c859b5812cce_s390x, multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:dcae2122c156f0b2ec7bcfa3f75d86cb7dce2f71d7b7e4de80b5c859b5812cce_s390x |
| Red Hat | multicluster-engine/cluster-curator-controller-rhel9@sha256:fda176390f2c88666c3062a2d80119d4213e866d7c290f33c60d9cbff9472cca_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | multicluster-engine/cluster-curator-controller-rhel9@sha256:fda176390f2c88666c3062a2d80119d4213e866d7c290f33c60d9cbff9472cca_amd64, * |
| Red Hat | multicluster-engine/addon-manager-rhel9@sha256:33599e704c834328838f6cbd0a098de2a7e29c09ba23e86c0a3d9256d159c44c_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | *, multicluster-engine/addon-manager-rhel9@sha256:33599e704c834328838f6cbd0a098de2a7e29c09ba23e86c0a3d9256d159c44c_s390x |
| Red Hat | multicluster-engine/cluster-image-set-controller-rhel9@sha256:b5a9c741ac2d340608211036a16b05a01937027e37254c907317e1a3f8afcf0b_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | *, multicluster-engine/cluster-image-set-controller-rhel9@sha256:b5a9c741ac2d340608211036a16b05a01937027e37254c907317e1a3f8afcf0b_arm64 |
| Red Hat | multicluster-engine/registration-operator-rhel9@sha256:c206725074205220efedbcbc537e0659bb41d8af1add378a0b1a0722cf874f01_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | multicluster-engine/registration-operator-rhel9@sha256:c206725074205220efedbcbc537e0659bb41d8af1add378a0b1a0722cf874f01_ppc64le, multicluster-engine/registration-operator-rhel9@sha256:c206725074205220efedbcbc537e0659bb41d8af1add378a0b1a0722cf874f01_ppc64le |
| Red Hat | multicluster-engine/managedcluster-import-controller-rhel9@sha256:0671f873fc16924f18de8b2268bef9baa62bfca165054477da44b1f1d60abff3_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | multicluster-engine/managedcluster-import-controller-rhel9@sha256:0671f873fc16924f18de8b2268bef9baa62bfca165054477da44b1f1d60abff3_arm64, multicluster-engine/managedcluster-import-controller-rhel9@sha256:0671f873fc16924f18de8b2268bef9baa62bfca165054477da44b1f1d60abff3_arm64 |
| Red Hat | multicluster-engine/managedcluster-import-controller-rhel9@sha256:32a055b86c019d8911686c5bd9c3ffc6914fb0e91e5c08c54815d6547245e2d6_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | multicluster-engine/managedcluster-import-controller-rhel9@sha256:32a055b86c019d8911686c5bd9c3ffc6914fb0e91e5c08c54815d6547245e2d6_s390x, multicluster-engine/managedcluster-import-controller-rhel9@sha256:32a055b86c019d8911686c5bd9c3ffc6914fb0e91e5c08c54815d6547245e2d6_s390x |
| Red Hat | multicluster-engine/assisted-image-service-rhel9@sha256:2764ed3c7fe82e3d8dc704008993a6b3c7bfafce5901fd24b48f1ca8ef3a6567_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | *, multicluster-engine/assisted-image-service-rhel9@sha256:2764ed3c7fe82e3d8dc704008993a6b3c7bfafce5901fd24b48f1ca8ef3a6567_s390x |
| Red Hat | multicluster-engine/assisted-service-9-rhel9@sha256:f9f3c1b29784995a9f7402622f3af8081e928714cf366ecdecdc0edf2553f45d_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | *, * |
| Red Hat | multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:91a90f95327dd227208364f8e40ab894b213a634707fb59ebb0caa082fe2f93a_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:91a90f95327dd227208364f8e40ab894b213a634707fb59ebb0caa082fe2f93a_ppc64le, multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:91a90f95327dd227208364f8e40ab894b213a634707fb59ebb0caa082fe2f93a_ppc64le |
| Red Hat | multicluster-engine/assisted-service-9-rhel9@sha256:7f1c0f68a2d06e7cb078bb73865e12b9a6b9a06d69cb5831a0f1931575159faf_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | multicluster-engine/assisted-service-9-rhel9@sha256:7f1c0f68a2d06e7cb078bb73865e12b9a6b9a06d69cb5831a0f1931575159faf_ppc64le, * |
| Red Hat | multicluster-engine/assisted-service-9-rhel9@sha256:7f1c0f68a2d06e7cb078bb73865e12b9a6b9a06d69cb5831a0f1931575159faf_ppc64le as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | *, multicluster-engine/assisted-service-9-rhel9@sha256:7f1c0f68a2d06e7cb078bb73865e12b9a6b9a06d69cb5831a0f1931575159faf_ppc64le |
| Red Hat | multicluster-engine/hypershift-addon-rhel9-operator@sha256:b78d4591023fdb748f923b0e1c29521b3bac87ed9f279ae6e28065ca3440566c_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | multicluster-engine/hypershift-addon-rhel9-operator@sha256:b78d4591023fdb748f923b0e1c29521b3bac87ed9f279ae6e28065ca3440566c_amd64, multicluster-engine/hypershift-addon-rhel9-operator@sha256:b78d4591023fdb748f923b0e1c29521b3bac87ed9f279ae6e28065ca3440566c_amd64 |
| Red Hat | multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:5cf58946528228fbcf6b101723366e843c1d25bd4b1e8b76b0c9deeafd21c4d9_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:5cf58946528228fbcf6b101723366e843c1d25bd4b1e8b76b0c9deeafd21c4d9_arm64, multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:5cf58946528228fbcf6b101723366e843c1d25bd4b1e8b76b0c9deeafd21c4d9_arm64 |
| Red Hat | multicluster-engine/work-rhel9@sha256:be5d614ea3298ae3bac337ad90486081c57da9f33fd1e3a22822a7d1bc21f39f_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | *, multicluster-engine/work-rhel9@sha256:be5d614ea3298ae3bac337ad90486081c57da9f33fd1e3a22822a7d1bc21f39f_arm64 |
| Red Hat | multicluster-engine/must-gather-rhel9@sha256:f4a598462891c9fa4aa495c7e18f77b977ce137115bef24cc9f9f128c45f4787_amd64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | multicluster-engine/must-gather-rhel9@sha256:f4a598462891c9fa4aa495c7e18f77b977ce137115bef24cc9f9f128c45f4787_amd64, multicluster-engine/must-gather-rhel9@sha256:f4a598462891c9fa4aa495c7e18f77b977ce137115bef24cc9f9f128c45f4787_amd64 |
| Red Hat | multicluster-engine/must-gather-rhel9@sha256:fd72db2925545752b643cb8b9a69edae8caa2f99d2bf326ce058ee269317c361_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | *, multicluster-engine/must-gather-rhel9@sha256:fd72db2925545752b643cb8b9a69edae8caa2f99d2bf326ce058ee269317c361_s390x |
| Red Hat | multicluster-engine/cluster-api-rhel9@sha256:fb396820a4a343a38b761732657b24896a9e63762d877aea94f37842e365f7bb_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | multicluster-engine/cluster-api-rhel9@sha256:fb396820a4a343a38b761732657b24896a9e63762d877aea94f37842e365f7bb_arm64, multicluster-engine/cluster-api-rhel9@sha256:fb396820a4a343a38b761732657b24896a9e63762d877aea94f37842e365f7bb_arm64 |
| Red Hat | multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:108eddb4fd696a74a646d3eaff11ec989fa695aa454574b86c8e9eb61b35d2f2_arm64 as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | *, * |
| Red Hat | multicluster-engine/discovery-rhel9@sha256:5afa49ba5310b9f8945fbaa72a112c017acbe00abfdec5bdeb7c99a3620cfe78_s390x as a component of multicluster engine for Kubernetes 2.7 for RHEL 9 | *, multicluster-engine/discovery-rhel9@sha256:5afa49ba5310b9f8945fbaa72a112c017acbe00abfdec5bdeb7c99a3620cfe78_s390x |
…and 258 more
Timeline
- Dec 5, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 4, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:10857 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://issues.redhat.com/browse/ACM-14863 advisory
- https://issues.redhat.com/browse/ACM-15018 advisory
- https://issues.redhat.com/browse/ACM-15277 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10857.json advisory
- https://access.redhat.com/security/cve/CVE-2023-47108 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2251198 issue
- https://www.cve.org/CVERecord?id=CVE-2023-47108 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-47108 advisory
- https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw advisory
- https://access.redhat.com/security/cve/CVE-2024-45296 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2310908 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45296 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45296 advisory
- https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f advisory
- https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6 advisory
- https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j advisory
- https://access.redhat.com/security/cve/CVE-2024-45813 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2313383 issue
…and 5 more