VDB
RHSA-2024%3A2639
RHSA-2024%3A2639
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. This flaw allows an attacker to craft malicious input tailored to trigger the identified flaw in the unmarshal function. By providing carefully constructed invalid inputs, they could potentially cause the function to enter an infinite loop, resulting in a denial of service condition or other unintended behaviors in the affected system.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhmtc/openshift-migration-openvpn-rhel8@sha256:d6d4e2c3717f82bd85d81f8992bbb81c30f5423ce4a9c2c781f3f13f4fcf7d2a_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-openvpn-rhel8@sha256:d6d4e2c3717f82bd85d81f8992bbb81c30f5423ce4a9c2c781f3f13f4fcf7d2a_amd64, *, rhmtc/openshift-migration-openvpn-rhel8@sha256:d6d4e2c3717f82bd85d81f8992bbb81c30f5423ce4a9c2c781f3f13f4fcf7d2a_amd64 |
| Red Hat | rhmtc/openshift-migration-ui-rhel8@sha256:39500437728e982296795d9e116a772221ec1f36d357d01918b82abf97b3aaa2_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-ui-rhel8@sha256:39500437728e982296795d9e116a772221ec1f36d357d01918b82abf97b3aaa2_amd64, *, * |
| Red Hat | rhmtc/openshift-migration-registry-rhel8@sha256:dda43dae1989c7f55471990df74b48584dc0789d1c94ce8cec7c9c06e134ddc8_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-registry-rhel8@sha256:dda43dae1989c7f55471990df74b48584dc0789d1c94ce8cec7c9c06e134ddc8_amd64, *, * |
| Red Hat | rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:d128bd063bae38f4a7405932ccf1f71a00deeea8fcae9ac86889556444c90bc1_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:d128bd063bae38f4a7405932ccf1f71a00deeea8fcae9ac86889556444c90bc1_amd64, rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:d128bd063bae38f4a7405932ccf1f71a00deeea8fcae9ac86889556444c90bc1_amd64, rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:d128bd063bae38f4a7405932ccf1f71a00deeea8fcae9ac86889556444c90bc1_amd64 |
| Red Hat | rhmtc/openshift-migration-registry-rhel8@sha256:dda43dae1989c7f55471990df74b48584dc0789d1c94ce8cec7c9c06e134ddc8_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-registry-rhel8@sha256:dda43dae1989c7f55471990df74b48584dc0789d1c94ce8cec7c9c06e134ddc8_amd64, rhmtc/openshift-migration-registry-rhel8@sha256:dda43dae1989c7f55471990df74b48584dc0789d1c94ce8cec7c9c06e134ddc8_amd64, rhmtc/openshift-migration-registry-rhel8@sha256:dda43dae1989c7f55471990df74b48584dc0789d1c94ce8cec7c9c06e134ddc8_amd64 |
| Red Hat | rhmtc/openshift-migration-openvpn-rhel8@sha256:d6d4e2c3717f82bd85d81f8992bbb81c30f5423ce4a9c2c781f3f13f4fcf7d2a_amd64 as a component of 8Base-RHMTC-1.7 | *, rhmtc/openshift-migration-openvpn-rhel8@sha256:d6d4e2c3717f82bd85d81f8992bbb81c30f5423ce4a9c2c781f3f13f4fcf7d2a_amd64, rhmtc/openshift-migration-openvpn-rhel8@sha256:d6d4e2c3717f82bd85d81f8992bbb81c30f5423ce4a9c2c781f3f13f4fcf7d2a_amd64 |
| Red Hat | rhmtc/openshift-migration-velero-restic-restore-helper-rhel8@sha256:d629598125de25b737c5a3e89b7c00716e83d1953a9d8b5bde802df07af8c1ee_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-velero-restic-restore-helper-rhel8@sha256:d629598125de25b737c5a3e89b7c00716e83d1953a9d8b5bde802df07af8c1ee_amd64, rhmtc/openshift-migration-velero-restic-restore-helper-rhel8@sha256:d629598125de25b737c5a3e89b7c00716e83d1953a9d8b5bde802df07af8c1ee_amd64, rhmtc/openshift-migration-velero-restic-restore-helper-rhel8@sha256:d629598125de25b737c5a3e89b7c00716e83d1953a9d8b5bde802df07af8c1ee_amd64 |
| Red Hat | rhmtc/openshift-migration-must-gather-rhel8@sha256:12c15fb95fb9928172bd0a7fed31e1fc95a360a56db958df88fe4368bbd6f463_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-must-gather-rhel8@sha256:12c15fb95fb9928172bd0a7fed31e1fc95a360a56db958df88fe4368bbd6f463_amd64, rhmtc/openshift-migration-must-gather-rhel8@sha256:12c15fb95fb9928172bd0a7fed31e1fc95a360a56db958df88fe4368bbd6f463_amd64, * |
| Red Hat | rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8@sha256:f6e3192d3e604e7b01e58e3dd8ecb16d93e4c7766c50b5b835256b9e55a36347_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8@sha256:f6e3192d3e604e7b01e58e3dd8ecb16d93e4c7766c50b5b835256b9e55a36347_amd64, *, * |
| Red Hat | rhmtc/openshift-migration-controller-rhel8@sha256:c312ff737af8d68dd54d16478940ec45b263aeafae10692d1b415b67e4ff85dd_amd64 as a component of 8Base-RHMTC-1.7 | *, rhmtc/openshift-migration-controller-rhel8@sha256:c312ff737af8d68dd54d16478940ec45b263aeafae10692d1b415b67e4ff85dd_amd64, rhmtc/openshift-migration-controller-rhel8@sha256:c312ff737af8d68dd54d16478940ec45b263aeafae10692d1b415b67e4ff85dd_amd64 |
| Red Hat | rhmtc/openshift-migration-hook-runner-rhel8@sha256:efe71724a81189dd6f32790706f4412c6e3705c78586bfc87bbd7a439c45e982_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-hook-runner-rhel8@sha256:efe71724a81189dd6f32790706f4412c6e3705c78586bfc87bbd7a439c45e982_amd64, rhmtc/openshift-migration-hook-runner-rhel8@sha256:efe71724a81189dd6f32790706f4412c6e3705c78586bfc87bbd7a439c45e982_amd64, rhmtc/openshift-migration-hook-runner-rhel8@sha256:efe71724a81189dd6f32790706f4412c6e3705c78586bfc87bbd7a439c45e982_amd64 |
| Red Hat | rhmtc/openshift-migration-operator-bundle@sha256:1b1f273e6ed2300ca64962f18a0402bba8a60c0629bb94da6aa16b90986ee558_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-operator-bundle@sha256:1b1f273e6ed2300ca64962f18a0402bba8a60c0629bb94da6aa16b90986ee558_amd64, rhmtc/openshift-migration-operator-bundle@sha256:1b1f273e6ed2300ca64962f18a0402bba8a60c0629bb94da6aa16b90986ee558_amd64, * |
| Red Hat | rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8@sha256:f6e3192d3e604e7b01e58e3dd8ecb16d93e4c7766c50b5b835256b9e55a36347_amd64 as a component of 8Base-RHMTC-1.7 | *, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8@sha256:f6e3192d3e604e7b01e58e3dd8ecb16d93e4c7766c50b5b835256b9e55a36347_amd64, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8@sha256:f6e3192d3e604e7b01e58e3dd8ecb16d93e4c7766c50b5b835256b9e55a36347_amd64 |
| Red Hat | rhmtc/openshift-migration-legacy-rhel8-operator@sha256:75107be29b4092fd644436000bff239dbfe9f4c5a4abb039737202bf14e73ca4_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-legacy-rhel8-operator@sha256:75107be29b4092fd644436000bff239dbfe9f4c5a4abb039737202bf14e73ca4_amd64, rhmtc/openshift-migration-legacy-rhel8-operator@sha256:75107be29b4092fd644436000bff239dbfe9f4c5a4abb039737202bf14e73ca4_amd64, rhmtc/openshift-migration-legacy-rhel8-operator@sha256:75107be29b4092fd644436000bff239dbfe9f4c5a4abb039737202bf14e73ca4_amd64 |
| Red Hat | rhmtc/openshift-migration-operator-bundle@sha256:1b1f273e6ed2300ca64962f18a0402bba8a60c0629bb94da6aa16b90986ee558_amd64 as a component of 8Base-RHMTC-1.7 | *, *, rhmtc/openshift-migration-operator-bundle@sha256:1b1f273e6ed2300ca64962f18a0402bba8a60c0629bb94da6aa16b90986ee558_amd64 |
| Red Hat | rhmtc/openshift-migration-velero-plugin-for-aws-rhel8@sha256:3452d0015f671f42d1282d7843f0511be7b3c218596d966dbe124203e4269530_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-velero-plugin-for-aws-rhel8@sha256:3452d0015f671f42d1282d7843f0511be7b3c218596d966dbe124203e4269530_amd64, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8@sha256:3452d0015f671f42d1282d7843f0511be7b3c218596d966dbe124203e4269530_amd64, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8@sha256:3452d0015f671f42d1282d7843f0511be7b3c218596d966dbe124203e4269530_amd64 |
| Red Hat | rhmtc/openshift-velero-plugin-rhel8@sha256:9d7b7894a61cb8e3a1037c1b874f3122ccc1dafc86b657bedf68350fde9ac0b8_amd64 as a component of 8Base-RHMTC-1.7 | *, rhmtc/openshift-velero-plugin-rhel8@sha256:9d7b7894a61cb8e3a1037c1b874f3122ccc1dafc86b657bedf68350fde9ac0b8_amd64, rhmtc/openshift-velero-plugin-rhel8@sha256:9d7b7894a61cb8e3a1037c1b874f3122ccc1dafc86b657bedf68350fde9ac0b8_amd64 |
| Red Hat | rhmtc/openshift-migration-velero-plugin-for-aws-rhel8@sha256:3452d0015f671f42d1282d7843f0511be7b3c218596d966dbe124203e4269530_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-velero-plugin-for-aws-rhel8@sha256:3452d0015f671f42d1282d7843f0511be7b3c218596d966dbe124203e4269530_amd64, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8@sha256:3452d0015f671f42d1282d7843f0511be7b3c218596d966dbe124203e4269530_amd64, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8@sha256:3452d0015f671f42d1282d7843f0511be7b3c218596d966dbe124203e4269530_amd64 |
| Red Hat | rhmtc/openshift-migration-hook-runner-rhel8@sha256:efe71724a81189dd6f32790706f4412c6e3705c78586bfc87bbd7a439c45e982_amd64 as a component of 8Base-RHMTC-1.7 | *, *, rhmtc/openshift-migration-hook-runner-rhel8@sha256:efe71724a81189dd6f32790706f4412c6e3705c78586bfc87bbd7a439c45e982_amd64 |
| Red Hat | rhmtc/openshift-migration-controller-rhel8@sha256:c312ff737af8d68dd54d16478940ec45b263aeafae10692d1b415b67e4ff85dd_amd64 as a component of 8Base-RHMTC-1.7 | rhmtc/openshift-migration-controller-rhel8@sha256:c312ff737af8d68dd54d16478940ec45b263aeafae10692d1b415b67e4ff85dd_amd64, rhmtc/openshift-migration-controller-rhel8@sha256:c312ff737af8d68dd54d16478940ec45b263aeafae10692d1b415b67e4ff85dd_amd64, rhmtc/openshift-migration-controller-rhel8@sha256:c312ff737af8d68dd54d16478940ec45b263aeafae10692d1b415b67e4ff85dd_amd64 |
…and 14 more
Timeline
- May 1, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:2639 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2268046 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2268854 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2639.json advisory
- https://access.redhat.com/security/cve/CVE-2024-24786 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-24786 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-24786 advisory
- https://go.dev/cl/569356 advisory
- https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/ advisory
- https://pkg.go.dev/vuln/GO-2024-2611 advisory
- https://access.redhat.com/security/cve/CVE-2024-28180 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-28180 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-28180 advisory
- https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g advisory