VDB
RHSA-2024%3A2874
RHSA-2024%3A2874
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. This flaw allows an attacker to craft malicious input tailored to trigger the identified flaw in the unmarshal function. By providing carefully constructed invalid inputs, they could potentially cause the function to enter an infinite loop, resulting in a denial of service condition or other unintended behaviors in the affected system.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ptp-must-gather-rhel8@sha256:8cb39af513379dfeae9e0d320e1435875778f46349d7309e52c4a728376e198f_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ptp-must-gather-rhel8@sha256:8cb39af513379dfeae9e0d320e1435875778f46349d7309e52c4a728376e198f_amd64, openshift4/ptp-must-gather-rhel8@sha256:8cb39af513379dfeae9e0d320e1435875778f46349d7309e52c4a728376e198f_amd64, openshift4/ptp-must-gather-rhel8@sha256:8cb39af513379dfeae9e0d320e1435875778f46349d7309e52c4a728376e198f_amd64 |
| Red Hat | openshift4/kubernetes-nmstate-rhel8-operator@sha256:23ecba97d562b8389a8a8a755c1c0fb6ff14da790479ee74069bc66dbf216945_ppc64le as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/kubernetes-nmstate-rhel8-operator@sha256:23ecba97d562b8389a8a8a755c1c0fb6ff14da790479ee74069bc66dbf216945_ppc64le, openshift4/kubernetes-nmstate-rhel8-operator@sha256:23ecba97d562b8389a8a8a755c1c0fb6ff14da790479ee74069bc66dbf216945_ppc64le, openshift4/kubernetes-nmstate-rhel8-operator@sha256:23ecba97d562b8389a8a8a755c1c0fb6ff14da790479ee74069bc66dbf216945_ppc64le |
| Red Hat | openshift4/ose-ansible-operator@sha256:1e01c4093ee4338be8defb0b98e9444336b12127a1ffe8d64b2bac28e4d81832_s390x as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-ansible-operator@sha256:1e01c4093ee4338be8defb0b98e9444336b12127a1ffe8d64b2bac28e4d81832_s390x, *, openshift4/ose-ansible-operator@sha256:1e01c4093ee4338be8defb0b98e9444336b12127a1ffe8d64b2bac28e4d81832_s390x |
| Red Hat | openshift4/ingress-node-firewall@sha256:8c28144679d53fb3489eba7a9444f2b8ba657b1eede846400216af7fbe56dd17_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ingress-node-firewall@sha256:8c28144679d53fb3489eba7a9444f2b8ba657b1eede846400216af7fbe56dd17_amd64, openshift4/ingress-node-firewall@sha256:8c28144679d53fb3489eba7a9444f2b8ba657b1eede846400216af7fbe56dd17_amd64, openshift4/ingress-node-firewall@sha256:8c28144679d53fb3489eba7a9444f2b8ba657b1eede846400216af7fbe56dd17_amd64 |
| Red Hat | openshift4/ose-sriov-network-webhook@sha256:ad5007731647bc70d68b5d858b976d122617adc1f0e9aa532fd168e610f44d45_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | *, openshift4/ose-sriov-network-webhook@sha256:ad5007731647bc70d68b5d858b976d122617adc1f0e9aa532fd168e610f44d45_amd64, * |
| Red Hat | openshift4/metallb-rhel8@sha256:efb9ba771a05965496cad47df9f54146eba375a759e9402d92d1f600e48e5d0b_ppc64le as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/metallb-rhel8@sha256:efb9ba771a05965496cad47df9f54146eba375a759e9402d92d1f600e48e5d0b_ppc64le, openshift4/metallb-rhel8@sha256:efb9ba771a05965496cad47df9f54146eba375a759e9402d92d1f600e48e5d0b_ppc64le, * |
| Red Hat | openshift4/ose-ansible-operator@sha256:437e6ba5aade8f6bdc77521a61734cf74b124aec569bc529a108c1f170f9e05c_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | *, openshift4/ose-ansible-operator@sha256:437e6ba5aade8f6bdc77521a61734cf74b124aec569bc529a108c1f170f9e05c_amd64, openshift4/ose-ansible-operator@sha256:437e6ba5aade8f6bdc77521a61734cf74b124aec569bc529a108c1f170f9e05c_amd64 |
| Red Hat | openshift4/ose-cluster-nfd-operator@sha256:0748fa4b07513e4bd370eca9348ccd3f2bcba5df95d59db53e613f0645e2e732_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cluster-nfd-operator@sha256:0748fa4b07513e4bd370eca9348ccd3f2bcba5df95d59db53e613f0645e2e732_amd64, *, * |
| Red Hat | openshift4/ose-egress-dns-proxy@sha256:819fc95ded1fa3a4f88cbc5d5c35c68d194c7e87459e52574f9da1dd55e9b92b_s390x as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-egress-dns-proxy@sha256:819fc95ded1fa3a4f88cbc5d5c35c68d194c7e87459e52574f9da1dd55e9b92b_s390x, openshift4/ose-egress-dns-proxy@sha256:819fc95ded1fa3a4f88cbc5d5c35c68d194c7e87459e52574f9da1dd55e9b92b_s390x, * |
| Red Hat | openshift4/ose-helm-operator@sha256:1e3a51111e3510d806beb43ec9763a6c43494e9c053f2b53450c7a93c3bb6527_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | *, *, openshift4/ose-helm-operator@sha256:1e3a51111e3510d806beb43ec9763a6c43494e9c053f2b53450c7a93c3bb6527_amd64 |
| Red Hat | openshift4/ose-vertical-pod-autoscaler-rhel8@sha256:1aa44a582feaeeb29e6b3110e324503fd43dff8a47a97c3bb1201725456a5677_s390x as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-vertical-pod-autoscaler-rhel8@sha256:1aa44a582feaeeb29e6b3110e324503fd43dff8a47a97c3bb1201725456a5677_s390x, openshift4/ose-vertical-pod-autoscaler-rhel8@sha256:1aa44a582feaeeb29e6b3110e324503fd43dff8a47a97c3bb1201725456a5677_s390x, openshift4/ose-vertical-pod-autoscaler-rhel8@sha256:1aa44a582feaeeb29e6b3110e324503fd43dff8a47a97c3bb1201725456a5677_s390x |
| Red Hat | openshift4/ose-cluster-kube-descheduler-operator@sha256:ad15255e8c713d7c719cb1b0dab1206f8b98e79f759b5fee6d69fe0e51f16a43_arm64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cluster-kube-descheduler-operator@sha256:ad15255e8c713d7c719cb1b0dab1206f8b98e79f759b5fee6d69fe0e51f16a43_arm64, *, openshift4/ose-cluster-kube-descheduler-operator@sha256:ad15255e8c713d7c719cb1b0dab1206f8b98e79f759b5fee6d69fe0e51f16a43_arm64 |
| Red Hat | openshift4/ose-descheduler@sha256:08c1494df4a46bdb4e6d4ac88b1c99fe9f8237347abbdf8043c32097612ed0d5_arm64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-descheduler@sha256:08c1494df4a46bdb4e6d4ac88b1c99fe9f8237347abbdf8043c32097612ed0d5_arm64, openshift4/ose-descheduler@sha256:08c1494df4a46bdb4e6d4ac88b1c99fe9f8237347abbdf8043c32097612ed0d5_arm64, * |
| Red Hat | openshift4/ose-aws-efs-csi-driver-container-rhel8@sha256:71eeab98dd8173f387120b1fdce42940d48d83a46da33ddefa4a63d36aaf1f63_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-aws-efs-csi-driver-container-rhel8@sha256:71eeab98dd8173f387120b1fdce42940d48d83a46da33ddefa4a63d36aaf1f63_amd64, *, openshift4/ose-aws-efs-csi-driver-container-rhel8@sha256:71eeab98dd8173f387120b1fdce42940d48d83a46da33ddefa4a63d36aaf1f63_amd64 |
| Red Hat | openshift4/sriov-cni-rhel9@sha256:803582200bcce769117452929bae8d023facad27ee63ea0c8f81487f1a94296d_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | *, openshift4/sriov-cni-rhel9@sha256:803582200bcce769117452929bae8d023facad27ee63ea0c8f81487f1a94296d_amd64, openshift4/sriov-cni-rhel9@sha256:803582200bcce769117452929bae8d023facad27ee63ea0c8f81487f1a94296d_amd64 |
| Red Hat | openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:e1e68c9e9fc813d83c1bf5d5578f6e95149fe87a9b4873d53dd969ae7becbf70_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:e1e68c9e9fc813d83c1bf5d5578f6e95149fe87a9b4873d53dd969ae7becbf70_amd64, *, openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:e1e68c9e9fc813d83c1bf5d5578f6e95149fe87a9b4873d53dd969ae7becbf70_amd64 |
| Red Hat | openshift4/ose-cluster-capacity@sha256:b03ca246391d4b80de25a3c3ce41fc908a53ac30eae399956e43e44aec8107af_ppc64le as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cluster-capacity@sha256:b03ca246391d4b80de25a3c3ce41fc908a53ac30eae399956e43e44aec8107af_ppc64le, openshift4/ose-cluster-capacity@sha256:b03ca246391d4b80de25a3c3ce41fc908a53ac30eae399956e43e44aec8107af_ppc64le, openshift4/ose-cluster-capacity@sha256:b03ca246391d4b80de25a3c3ce41fc908a53ac30eae399956e43e44aec8107af_ppc64le |
| Red Hat | openshift4/ose-sriov-network-config-daemon@sha256:e1fe5047bb855af434f45225dcf0eef6d47a0605f61b182dc2746ada717f1d70_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-sriov-network-config-daemon@sha256:e1fe5047bb855af434f45225dcf0eef6d47a0605f61b182dc2746ada717f1d70_amd64, openshift4/ose-sriov-network-config-daemon@sha256:e1fe5047bb855af434f45225dcf0eef6d47a0605f61b182dc2746ada717f1d70_amd64, openshift4/ose-sriov-network-config-daemon@sha256:e1fe5047bb855af434f45225dcf0eef6d47a0605f61b182dc2746ada717f1d70_amd64 |
| Red Hat | openshift4/ose-gcp-filestore-csi-driver-rhel8@sha256:17090f5795f463bdb9c80f021c7f5932ba91e899b7eadf7c65a1b6abdcce1c04_arm64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-gcp-filestore-csi-driver-rhel8@sha256:17090f5795f463bdb9c80f021c7f5932ba91e899b7eadf7c65a1b6abdcce1c04_arm64, openshift4/ose-gcp-filestore-csi-driver-rhel8@sha256:17090f5795f463bdb9c80f021c7f5932ba91e899b7eadf7c65a1b6abdcce1c04_arm64, openshift4/ose-gcp-filestore-csi-driver-rhel8@sha256:17090f5795f463bdb9c80f021c7f5932ba91e899b7eadf7c65a1b6abdcce1c04_arm64 |
| Red Hat | openshift4/ose-egress-router@sha256:3856b783b122f17b6ee9b224c85f01f2b0a401ad9e0431af98dbcc68e169f113_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-egress-router@sha256:3856b783b122f17b6ee9b224c85f01f2b0a401ad9e0431af98dbcc68e169f113_amd64, *, openshift4/ose-egress-router@sha256:3856b783b122f17b6ee9b224c85f01f2b0a401ad9e0431af98dbcc68e169f113_amd64 |
…and 300 more
Timeline
- May 23, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:2874 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2268046 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2874.json advisory
- https://access.redhat.com/security/cve/CVE-2024-24786 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-24786 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-24786 advisory
- https://go.dev/cl/569356 advisory
- https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/ advisory
- https://pkg.go.dev/vuln/GO-2024-2611 advisory