VDB
RHSA-2024%3A2666
RHSA-2024%3A2666
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. This flaw allows an attacker to craft malicious input tailored to trigger the identified flaw in the unmarshal function. By providing carefully constructed invalid inputs, they could potentially cause the function to enter an infinite loop, resulting in a denial of service condition or other unintended behaviors in the affected system.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-local-storage-mustgather-rhel8@sha256:95a9b0b03ee0b43847f2fe30842d8797482ab366c6c924b9f2e1168c47a224da_s390x as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-local-storage-mustgather-rhel8@sha256:95a9b0b03ee0b43847f2fe30842d8797482ab366c6c924b9f2e1168c47a224da_s390x, openshift4/ose-local-storage-mustgather-rhel8@sha256:95a9b0b03ee0b43847f2fe30842d8797482ab366c6c924b9f2e1168c47a224da_s390x, openshift4/ose-local-storage-mustgather-rhel8@sha256:95a9b0b03ee0b43847f2fe30842d8797482ab366c6c924b9f2e1168c47a224da_s390x |
| Red Hat | openshift4/ose-node-feature-discovery@sha256:1addfe3f1427dedd756336e7a9814c09fc338ff687b8f6b14992d94d8430f756_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | *, openshift4/ose-node-feature-discovery@sha256:1addfe3f1427dedd756336e7a9814c09fc338ff687b8f6b14992d94d8430f756_ppc64le, openshift4/ose-node-feature-discovery@sha256:1addfe3f1427dedd756336e7a9814c09fc338ff687b8f6b14992d94d8430f756_ppc64le |
| Red Hat | openshift4/ose-clusterresourceoverride-rhel8@sha256:f8b787e4a0660cbb01c774658e42ab7c8a663ac8011da96a34c983a2b5db01f6_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-clusterresourceoverride-rhel8@sha256:f8b787e4a0660cbb01c774658e42ab7c8a663ac8011da96a34c983a2b5db01f6_arm64, *, * |
| Red Hat | openshift4/ose-cluster-kube-descheduler-operator@sha256:9746c73224e76cbd113bb9b9bf012136cf1ebf6edf7395492c98cdcbf5a41de8_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-cluster-kube-descheduler-operator@sha256:9746c73224e76cbd113bb9b9bf012136cf1ebf6edf7395492c98cdcbf5a41de8_amd64, openshift4/ose-cluster-kube-descheduler-operator@sha256:9746c73224e76cbd113bb9b9bf012136cf1ebf6edf7395492c98cdcbf5a41de8_amd64, * |
| Red Hat | openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:aaacfcad036f72fbbcda4c6502c3dc8879024b1351bf3a4889ff02420ef7ef1b_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:aaacfcad036f72fbbcda4c6502c3dc8879024b1351bf3a4889ff02420ef7ef1b_ppc64le, openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:aaacfcad036f72fbbcda4c6502c3dc8879024b1351bf3a4889ff02420ef7ef1b_ppc64le, openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:aaacfcad036f72fbbcda4c6502c3dc8879024b1351bf3a4889ff02420ef7ef1b_ppc64le |
| Red Hat | openshift4/ose-cluster-capacity@sha256:deb076ce48539d0befbaf2d4414f846fdcaf2b75f331c5b262e39bd8d4a385aa_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-cluster-capacity@sha256:deb076ce48539d0befbaf2d4414f846fdcaf2b75f331c5b262e39bd8d4a385aa_arm64, *, openshift4/ose-cluster-capacity@sha256:deb076ce48539d0befbaf2d4414f846fdcaf2b75f331c5b262e39bd8d4a385aa_arm64 |
| Red Hat | openshift4/ose-secrets-store-csi-driver-rhel8-operator@sha256:2ef8d6082ba24be4459267146f2094446a629b9daf1bb10248419838f0ac7783_s390x as a component of Red Hat OpenShift Container Platform 4.14 | *, openshift4/ose-secrets-store-csi-driver-rhel8-operator@sha256:2ef8d6082ba24be4459267146f2094446a629b9daf1bb10248419838f0ac7783_s390x, openshift4/ose-secrets-store-csi-driver-rhel8-operator@sha256:2ef8d6082ba24be4459267146f2094446a629b9daf1bb10248419838f0ac7783_s390x |
| Red Hat | openshift4/ose-egress-http-proxy@sha256:af6df7e2be57eaced05ca7333ef53a582288476fc1f05137ae57a1bafb4fa762_s390x as a component of Red Hat OpenShift Container Platform 4.14 | *, openshift4/ose-egress-http-proxy@sha256:af6df7e2be57eaced05ca7333ef53a582288476fc1f05137ae57a1bafb4fa762_s390x, openshift4/ose-egress-http-proxy@sha256:af6df7e2be57eaced05ca7333ef53a582288476fc1f05137ae57a1bafb4fa762_s390x |
| Red Hat | openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:534f8843d54cf43241f51dda84be8c6e4d943be6224721a50d538378e596d010_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:534f8843d54cf43241f51dda84be8c6e4d943be6224721a50d538378e596d010_amd64, openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:534f8843d54cf43241f51dda84be8c6e4d943be6224721a50d538378e596d010_amd64, openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:534f8843d54cf43241f51dda84be8c6e4d943be6224721a50d538378e596d010_amd64 |
| Red Hat | openshift4/frr-rhel9@sha256:5d861b0953897f40dea94e7cf86d782d1a76f41026ea5b240d76819c84734edb_s390x as a component of Red Hat OpenShift Container Platform 4.14 | *, openshift4/frr-rhel9@sha256:5d861b0953897f40dea94e7cf86d782d1a76f41026ea5b240d76819c84734edb_s390x, openshift4/frr-rhel9@sha256:5d861b0953897f40dea94e7cf86d782d1a76f41026ea5b240d76819c84734edb_s390x |
| Red Hat | openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:47f30e4f72b8bfcddad29251d766de8f0b0f0abce15ae2e55f280023a98238bf_s390x as a component of Red Hat OpenShift Container Platform 4.14 | *, openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:47f30e4f72b8bfcddad29251d766de8f0b0f0abce15ae2e55f280023a98238bf_s390x, openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:47f30e4f72b8bfcddad29251d766de8f0b0f0abce15ae2e55f280023a98238bf_s390x |
| Red Hat | openshift4/nmstate-console-plugin-rhel8@sha256:6fcdf8f95b553e227e0dfff15fdd0185a6a17c6dcf3a0c58ad4a070c53b76636_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/nmstate-console-plugin-rhel8@sha256:6fcdf8f95b553e227e0dfff15fdd0185a6a17c6dcf3a0c58ad4a070c53b76636_arm64, *, * |
| Red Hat | openshift4/ose-cloud-event-proxy-rhel8@sha256:ee9012d88abfae862e742a7ed1c3bb5f1345511eaec0b2c03d43ffcdada227cf_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | *, *, openshift4/ose-cloud-event-proxy-rhel8@sha256:ee9012d88abfae862e742a7ed1c3bb5f1345511eaec0b2c03d43ffcdada227cf_ppc64le |
| Red Hat | openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:534f8843d54cf43241f51dda84be8c6e4d943be6224721a50d538378e596d010_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:534f8843d54cf43241f51dda84be8c6e4d943be6224721a50d538378e596d010_amd64, *, openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:534f8843d54cf43241f51dda84be8c6e4d943be6224721a50d538378e596d010_amd64 |
| Red Hat | openshift4/ose-helm-operator@sha256:c028cb80232e8377e0daea8719743fd9332ec5824d3b692d734f89a425dafe3a_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-helm-operator@sha256:c028cb80232e8377e0daea8719743fd9332ec5824d3b692d734f89a425dafe3a_amd64, openshift4/ose-helm-operator@sha256:c028cb80232e8377e0daea8719743fd9332ec5824d3b692d734f89a425dafe3a_amd64, openshift4/ose-helm-operator@sha256:c028cb80232e8377e0daea8719743fd9332ec5824d3b692d734f89a425dafe3a_amd64 |
| Red Hat | openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:47f30e4f72b8bfcddad29251d766de8f0b0f0abce15ae2e55f280023a98238bf_s390x as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:47f30e4f72b8bfcddad29251d766de8f0b0f0abce15ae2e55f280023a98238bf_s390x, openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:47f30e4f72b8bfcddad29251d766de8f0b0f0abce15ae2e55f280023a98238bf_s390x, openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:47f30e4f72b8bfcddad29251d766de8f0b0f0abce15ae2e55f280023a98238bf_s390x |
| Red Hat | openshift4/ose-clusterresourceoverride-rhel8@sha256:f8b787e4a0660cbb01c774658e42ab7c8a663ac8011da96a34c983a2b5db01f6_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | *, openshift4/ose-clusterresourceoverride-rhel8@sha256:f8b787e4a0660cbb01c774658e42ab7c8a663ac8011da96a34c983a2b5db01f6_arm64, * |
| Red Hat | openshift4/ose-cluster-kube-descheduler-operator@sha256:60e77f5859624a810af4b5334ce872a678eb4c508d6a5e4700efdda88da869f3_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-cluster-kube-descheduler-operator@sha256:60e77f5859624a810af4b5334ce872a678eb4c508d6a5e4700efdda88da869f3_ppc64le, openshift4/ose-cluster-kube-descheduler-operator@sha256:60e77f5859624a810af4b5334ce872a678eb4c508d6a5e4700efdda88da869f3_ppc64le, openshift4/ose-cluster-kube-descheduler-operator@sha256:60e77f5859624a810af4b5334ce872a678eb4c508d6a5e4700efdda88da869f3_ppc64le |
| Red Hat | openshift4/ose-ptp-operator@sha256:f4ce0cb6bae074e2f3f06024b258d8850a8433928f70ef4082700481324afbae_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-ptp-operator@sha256:f4ce0cb6bae074e2f3f06024b258d8850a8433928f70ef4082700481324afbae_amd64, *, openshift4/ose-ptp-operator@sha256:f4ce0cb6bae074e2f3f06024b258d8850a8433928f70ef4082700481324afbae_amd64 |
| Red Hat | openshift4/ose-secrets-store-csi-driver-rhel8@sha256:90c15dc5376776d8ff981fa0198bbfe26ed0dd8ceff0a9e757b3842938a9c936_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-secrets-store-csi-driver-rhel8@sha256:90c15dc5376776d8ff981fa0198bbfe26ed0dd8ceff0a9e757b3842938a9c936_ppc64le, openshift4/ose-secrets-store-csi-driver-rhel8@sha256:90c15dc5376776d8ff981fa0198bbfe26ed0dd8ceff0a9e757b3842938a9c936_ppc64le, openshift4/ose-secrets-store-csi-driver-rhel8@sha256:90c15dc5376776d8ff981fa0198bbfe26ed0dd8ceff0a9e757b3842938a9c936_ppc64le |
…and 292 more
Timeline
- May 9, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:2666 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2268046 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2666.json advisory
- https://access.redhat.com/security/cve/CVE-2024-24786 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-24786 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-24786 advisory
- https://go.dev/cl/569356 advisory
- https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/ advisory
- https://pkg.go.dev/vuln/GO-2024-2611 advisory