VDB
RHSA-2024%3A3683
RHSA-2024%3A3683
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. This flaw allows an attacker to craft malicious input tailored to trigger the identified flaw in the unmarshal function. By providing carefully constructed invalid inputs, they could potentially cause the function to enter an infinite loop, resulting in a denial of service condition or other unintended behaviors in the affected system.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-service-mesh/proxyv2-rhel8@sha256:bad1f05ed351363a4f315b5459a6448c68a62289cdbcd7fce8aba2432fad33f4_ppc64le as a component of RHOSSM 2.5 for RHEL 8 | *, openshift-service-mesh/proxyv2-rhel8@sha256:bad1f05ed351363a4f315b5459a6448c68a62289cdbcd7fce8aba2432fad33f4_ppc64le, openshift-service-mesh/proxyv2-rhel8@sha256:bad1f05ed351363a4f315b5459a6448c68a62289cdbcd7fce8aba2432fad33f4_ppc64le |
| Red Hat | openshift-service-mesh/istio-must-gather-rhel8@sha256:1cdee6bbd92342d0e14374547fe036e649757ba2a93afc9ff3d4965e6b38c8c8_ppc64le as a component of RHOSSM 2.5 for RHEL 8 | *, openshift-service-mesh/istio-must-gather-rhel8@sha256:1cdee6bbd92342d0e14374547fe036e649757ba2a93afc9ff3d4965e6b38c8c8_ppc64le, openshift-service-mesh/istio-must-gather-rhel8@sha256:1cdee6bbd92342d0e14374547fe036e649757ba2a93afc9ff3d4965e6b38c8c8_ppc64le |
| Red Hat | openshift-service-mesh/kiali-rhel8-operator@sha256:1505deb27fea3f779281fafdb43c369feecc3c8381d455880f6f9698adcea356_arm64 as a component of RHOSSM 2.5 for RHEL 8 | *, openshift-service-mesh/kiali-rhel8-operator@sha256:1505deb27fea3f779281fafdb43c369feecc3c8381d455880f6f9698adcea356_arm64, openshift-service-mesh/kiali-rhel8-operator@sha256:1505deb27fea3f779281fafdb43c369feecc3c8381d455880f6f9698adcea356_arm64 |
| Red Hat | openshift-service-mesh/istio-cni-rhel8@sha256:0919bd3209d65d64a59b11f558c7270720b50e0fc6a2b69f60384001ad534eba_ppc64le as a component of RHOSSM 2.5 for RHEL 8 | openshift-service-mesh/istio-cni-rhel8@sha256:0919bd3209d65d64a59b11f558c7270720b50e0fc6a2b69f60384001ad534eba_ppc64le, openshift-service-mesh/istio-cni-rhel8@sha256:0919bd3209d65d64a59b11f558c7270720b50e0fc6a2b69f60384001ad534eba_ppc64le, openshift-service-mesh/istio-cni-rhel8@sha256:0919bd3209d65d64a59b11f558c7270720b50e0fc6a2b69f60384001ad534eba_ppc64le |
| Red Hat | openshift-service-mesh/istio-rhel8-operator@sha256:3c2238f829ff0916a52036daa96c506adfb1a18bbd6949cd4360cc50ce63b6c0_s390x as a component of RHOSSM 2.5 for RHEL 8 | openshift-service-mesh/istio-rhel8-operator@sha256:3c2238f829ff0916a52036daa96c506adfb1a18bbd6949cd4360cc50ce63b6c0_s390x, *, * |
| Red Hat | openshift-service-mesh/istio-cni-rhel8@sha256:56567284a3980bc6ec153e29a6485289de9643872ae223f1c080813c58e7603a_amd64 as a component of RHOSSM 2.5 for RHEL 8 | openshift-service-mesh/istio-cni-rhel8@sha256:56567284a3980bc6ec153e29a6485289de9643872ae223f1c080813c58e7603a_amd64, openshift-service-mesh/istio-cni-rhel8@sha256:56567284a3980bc6ec153e29a6485289de9643872ae223f1c080813c58e7603a_amd64, * |
| Red Hat | openshift-service-mesh/grafana-rhel8@sha256:9bcd4b5aca1fc357e9e92b8d940645836d7903377547806df101ea93460398d1_arm64 as a component of RHOSSM 2.5 for RHEL 8 | openshift-service-mesh/grafana-rhel8@sha256:9bcd4b5aca1fc357e9e92b8d940645836d7903377547806df101ea93460398d1_arm64, *, openshift-service-mesh/grafana-rhel8@sha256:9bcd4b5aca1fc357e9e92b8d940645836d7903377547806df101ea93460398d1_arm64 |
| Red Hat | openshift-service-mesh/kiali-rhel8@sha256:b9fbde1bb4853041156492398fd6041500648f2b1ee602211732db8d633f38de_amd64 as a component of RHOSSM 2.5 for RHEL 8 | *, *, * |
| Red Hat | openshift-service-mesh/grafana-rhel8@sha256:a1e314d8b22764a77d9b83ea60e533576b848aa748a67c0104ce694b7ecb2bbd_amd64 as a component of RHOSSM 2.5 for RHEL 8 | openshift-service-mesh/grafana-rhel8@sha256:a1e314d8b22764a77d9b83ea60e533576b848aa748a67c0104ce694b7ecb2bbd_amd64, openshift-service-mesh/grafana-rhel8@sha256:a1e314d8b22764a77d9b83ea60e533576b848aa748a67c0104ce694b7ecb2bbd_amd64, openshift-service-mesh/grafana-rhel8@sha256:a1e314d8b22764a77d9b83ea60e533576b848aa748a67c0104ce694b7ecb2bbd_amd64 |
| Red Hat | openshift-service-mesh/kiali-rhel8-operator@sha256:56c42a406cc6c823a00e94162b4fde5567a3b596e910924de937244f946a6ea3_ppc64le as a component of RHOSSM 2.5 for RHEL 8 | *, openshift-service-mesh/kiali-rhel8-operator@sha256:56c42a406cc6c823a00e94162b4fde5567a3b596e910924de937244f946a6ea3_ppc64le, openshift-service-mesh/kiali-rhel8-operator@sha256:56c42a406cc6c823a00e94162b4fde5567a3b596e910924de937244f946a6ea3_ppc64le |
| Red Hat | openshift-service-mesh/kiali-rhel8-operator@sha256:373682372ef03b6b2e08f6be87b1e4152c8d05aec66672934f9f503c658b28fb_amd64 as a component of RHOSSM 2.5 for RHEL 8 | *, openshift-service-mesh/kiali-rhel8-operator@sha256:373682372ef03b6b2e08f6be87b1e4152c8d05aec66672934f9f503c658b28fb_amd64, * |
| Red Hat | openshift-service-mesh/pilot-rhel8@sha256:1afd56ec54aa68bd803d7d8f11f567c6b27ac71db456a77befbf66739dddd58f_amd64 as a component of RHOSSM 2.5 for RHEL 8 | *, *, openshift-service-mesh/pilot-rhel8@sha256:1afd56ec54aa68bd803d7d8f11f567c6b27ac71db456a77befbf66739dddd58f_amd64 |
| Red Hat | openshift-service-mesh/kiali-rhel8@sha256:be9b3a837c877a06a21ab5ffd799a44055b3af044c4a87770b35cc373be23135_s390x as a component of RHOSSM 2.5 for RHEL 8 | openshift-service-mesh/kiali-rhel8@sha256:be9b3a837c877a06a21ab5ffd799a44055b3af044c4a87770b35cc373be23135_s390x, openshift-service-mesh/kiali-rhel8@sha256:be9b3a837c877a06a21ab5ffd799a44055b3af044c4a87770b35cc373be23135_s390x, * |
| Red Hat | openshift-service-mesh/proxyv2-rhel8@sha256:bad1f05ed351363a4f315b5459a6448c68a62289cdbcd7fce8aba2432fad33f4_ppc64le as a component of RHOSSM 2.5 for RHEL 8 | openshift-service-mesh/proxyv2-rhel8@sha256:bad1f05ed351363a4f315b5459a6448c68a62289cdbcd7fce8aba2432fad33f4_ppc64le, openshift-service-mesh/proxyv2-rhel8@sha256:bad1f05ed351363a4f315b5459a6448c68a62289cdbcd7fce8aba2432fad33f4_ppc64le, openshift-service-mesh/proxyv2-rhel8@sha256:bad1f05ed351363a4f315b5459a6448c68a62289cdbcd7fce8aba2432fad33f4_ppc64le |
| Red Hat | openshift-service-mesh/istio-cni-rhel8@sha256:3f59e13cd8da98df0c34c8e50ae00f2b0fcd018e6030b417e13cc6f087c3b587_s390x as a component of RHOSSM 2.5 for RHEL 8 | openshift-service-mesh/istio-cni-rhel8@sha256:3f59e13cd8da98df0c34c8e50ae00f2b0fcd018e6030b417e13cc6f087c3b587_s390x, openshift-service-mesh/istio-cni-rhel8@sha256:3f59e13cd8da98df0c34c8e50ae00f2b0fcd018e6030b417e13cc6f087c3b587_s390x, * |
| Red Hat | openshift-service-mesh/istio-cni-rhel8@sha256:56567284a3980bc6ec153e29a6485289de9643872ae223f1c080813c58e7603a_amd64 as a component of RHOSSM 2.5 for RHEL 8 | *, openshift-service-mesh/istio-cni-rhel8@sha256:56567284a3980bc6ec153e29a6485289de9643872ae223f1c080813c58e7603a_amd64, openshift-service-mesh/istio-cni-rhel8@sha256:56567284a3980bc6ec153e29a6485289de9643872ae223f1c080813c58e7603a_amd64 |
| Red Hat | openshift-service-mesh/istio-cni-rhel8@sha256:f17220f19aac2f8687e7533c63139d3c1a63f92b83f85bd6df2d98a0abe82088_arm64 as a component of RHOSSM 2.5 for RHEL 8 | openshift-service-mesh/istio-cni-rhel8@sha256:f17220f19aac2f8687e7533c63139d3c1a63f92b83f85bd6df2d98a0abe82088_arm64, openshift-service-mesh/istio-cni-rhel8@sha256:f17220f19aac2f8687e7533c63139d3c1a63f92b83f85bd6df2d98a0abe82088_arm64, * |
| Red Hat | openshift-service-mesh/istio-rhel8-operator@sha256:3c2238f829ff0916a52036daa96c506adfb1a18bbd6949cd4360cc50ce63b6c0_s390x as a component of RHOSSM 2.5 for RHEL 8 | *, *, openshift-service-mesh/istio-rhel8-operator@sha256:3c2238f829ff0916a52036daa96c506adfb1a18bbd6949cd4360cc50ce63b6c0_s390x |
| Red Hat | openshift-service-mesh/istio-cni-rhel8@sha256:f17220f19aac2f8687e7533c63139d3c1a63f92b83f85bd6df2d98a0abe82088_arm64 as a component of RHOSSM 2.5 for RHEL 8 | openshift-service-mesh/istio-cni-rhel8@sha256:f17220f19aac2f8687e7533c63139d3c1a63f92b83f85bd6df2d98a0abe82088_arm64, *, * |
| Red Hat | openshift-service-mesh/kiali-rhel8-operator@sha256:761f4924f82c44478beadd811c0a6ef35dfa0a54d8c43ffae17b039c78b7d2b0_s390x as a component of RHOSSM 2.5 for RHEL 8 | openshift-service-mesh/kiali-rhel8-operator@sha256:761f4924f82c44478beadd811c0a6ef35dfa0a54d8c43ffae17b039c78b7d2b0_s390x, openshift-service-mesh/kiali-rhel8-operator@sha256:761f4924f82c44478beadd811c0a6ef35dfa0a54d8c43ffae17b039c78b7d2b0_s390x, openshift-service-mesh/kiali-rhel8-operator@sha256:761f4924f82c44478beadd811c0a6ef35dfa0a54d8c43ffae17b039c78b7d2b0_s390x |
…and 60 more
Timeline
- Jun 6, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:3683 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2268046 issue
- https://issues.redhat.com/browse/OSSM-6290 advisory
- https://issues.redhat.com/browse/OSSM-6295 advisory
- https://issues.redhat.com/browse/OSSM-6298 advisory
- https://issues.redhat.com/browse/OSSM-6299 advisory
- https://issues.redhat.com/browse/OSSM-6397 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3683.json advisory
- https://access.redhat.com/security/cve/CVE-2024-24786 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-24786 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-24786 advisory
- https://go.dev/cl/569356 advisory
- https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/ advisory
- https://pkg.go.dev/vuln/GO-2024-2611 advisory