VDB
RHSA-2024%3A4150
RHSA-2024%3A4150
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. This flaw allows an attacker to craft malicious input tailored to trigger the identified flaw in the unmarshal function. By providing carefully constructed invalid inputs, they could potentially cause the function to enter an infinite loop, resulting in a denial of service condition or other unintended behaviors in the affected system.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-node-feature-discovery-rhel9@sha256:17dd1a9c3dbb461f5f783e39b5593a2fa2c1772c08f49693c50a72744cf9f181_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-node-feature-discovery-rhel9@sha256:17dd1a9c3dbb461f5f783e39b5593a2fa2c1772c08f49693c50a72744cf9f181_s390x, *, openshift4/ose-node-feature-discovery-rhel9@sha256:17dd1a9c3dbb461f5f783e39b5593a2fa2c1772c08f49693c50a72744cf9f181_s390x |
| Red Hat | openshift4/ingress-node-firewall-rhel9@sha256:cbd34951e9b8e617fdb37a13e26de67f21581091039c0bb331d5350a0d500db4_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ingress-node-firewall-rhel9@sha256:cbd34951e9b8e617fdb37a13e26de67f21581091039c0bb331d5350a0d500db4_s390x, *, * |
| Red Hat | openshift4/ose-secrets-store-csi-driver-rhel8@sha256:41aa0cbf5d40044e46bdb8a8a8022c2fb678d1cd72659894c80648213aef19b0_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-secrets-store-csi-driver-rhel8@sha256:41aa0cbf5d40044e46bdb8a8a8022c2fb678d1cd72659894c80648213aef19b0_ppc64le, openshift4/ose-secrets-store-csi-driver-rhel8@sha256:41aa0cbf5d40044e46bdb8a8a8022c2fb678d1cd72659894c80648213aef19b0_ppc64le, openshift4/ose-secrets-store-csi-driver-rhel8@sha256:41aa0cbf5d40044e46bdb8a8a8022c2fb678d1cd72659894c80648213aef19b0_ppc64le |
| Red Hat | openshift4/ose-secrets-store-csi-mustgather-rhel8@sha256:548e85369a6bb9b583ac8683c6f4387d8a7d0ac7863b4fc280beb956a8455a77_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-secrets-store-csi-mustgather-rhel8@sha256:548e85369a6bb9b583ac8683c6f4387d8a7d0ac7863b4fc280beb956a8455a77_ppc64le, openshift4/ose-secrets-store-csi-mustgather-rhel8@sha256:548e85369a6bb9b583ac8683c6f4387d8a7d0ac7863b4fc280beb956a8455a77_ppc64le, openshift4/ose-secrets-store-csi-mustgather-rhel8@sha256:548e85369a6bb9b583ac8683c6f4387d8a7d0ac7863b4fc280beb956a8455a77_ppc64le |
| Red Hat | openshift4/ptp-must-gather-rhel8@sha256:99159c76ff450112099d5289f9ccf08a8c2898e71d132aad0ae9679d954a3349_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ptp-must-gather-rhel8@sha256:99159c76ff450112099d5289f9ccf08a8c2898e71d132aad0ae9679d954a3349_arm64, openshift4/ptp-must-gather-rhel8@sha256:99159c76ff450112099d5289f9ccf08a8c2898e71d132aad0ae9679d954a3349_arm64, openshift4/ptp-must-gather-rhel8@sha256:99159c76ff450112099d5289f9ccf08a8c2898e71d132aad0ae9679d954a3349_arm64 |
| Red Hat | openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:8acda1e96e177d0c803789544001e2b946c5d41e3d3da239864073e87581d085_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:8acda1e96e177d0c803789544001e2b946c5d41e3d3da239864073e87581d085_ppc64le, openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:8acda1e96e177d0c803789544001e2b946c5d41e3d3da239864073e87581d085_ppc64le, openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:8acda1e96e177d0c803789544001e2b946c5d41e3d3da239864073e87581d085_ppc64le |
| Red Hat | openshift4/ose-egress-http-proxy@sha256:8346b5200347ba4eab8c4be97eb1b79bd36f6742e2fad5b6d11e0d13caca6978_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-egress-http-proxy@sha256:8346b5200347ba4eab8c4be97eb1b79bd36f6742e2fad5b6d11e0d13caca6978_s390x, openshift4/ose-egress-http-proxy@sha256:8346b5200347ba4eab8c4be97eb1b79bd36f6742e2fad5b6d11e0d13caca6978_s390x, openshift4/ose-egress-http-proxy@sha256:8346b5200347ba4eab8c4be97eb1b79bd36f6742e2fad5b6d11e0d13caca6978_s390x |
| Red Hat | openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:4132085cbe373f94a4943402bd24a5d91135229655e3df0eb4a43139efee2d30_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:4132085cbe373f94a4943402bd24a5d91135229655e3df0eb4a43139efee2d30_arm64, openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:4132085cbe373f94a4943402bd24a5d91135229655e3df0eb4a43139efee2d30_arm64, openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:4132085cbe373f94a4943402bd24a5d91135229655e3df0eb4a43139efee2d30_arm64 |
| Red Hat | openshift4/ose-egress-dns-proxy@sha256:1b9ad823330a1ed538c8d5de587d47226a8db7aec84181b38c45cf919619a5c8_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-egress-dns-proxy@sha256:1b9ad823330a1ed538c8d5de587d47226a8db7aec84181b38c45cf919619a5c8_s390x, *, * |
| Red Hat | openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:feeeee4c672332c2fd74da8540e587c3f6f8991694bc61fbdfd815bccd75bfdc_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:feeeee4c672332c2fd74da8540e587c3f6f8991694bc61fbdfd815bccd75bfdc_ppc64le, openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:feeeee4c672332c2fd74da8540e587c3f6f8991694bc61fbdfd815bccd75bfdc_ppc64le, openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:feeeee4c672332c2fd74da8540e587c3f6f8991694bc61fbdfd815bccd75bfdc_ppc64le |
| Red Hat | openshift4/ose-cluster-nfd-rhel9-operator@sha256:65c5e960f8ff1f830eb451a9162849cf903fffdec6699fcce501b82594dae77d_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | *, *, * |
| Red Hat | openshift4/ose-secrets-store-csi-mustgather-rhel8@sha256:298b60d30d504e8dee6960197bc2def886643d249de16b5b7a14cca65304bc73_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | *, *, * |
| Red Hat | openshift4/ose-local-storage-diskmaker-rhel9@sha256:18bbf3f34bce5e82ca068c1a6709c03d76d0d3ac4bc182ba4c08f5b841752658_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | *, openshift4/ose-local-storage-diskmaker-rhel9@sha256:18bbf3f34bce5e82ca068c1a6709c03d76d0d3ac4bc182ba4c08f5b841752658_ppc64le, openshift4/ose-local-storage-diskmaker-rhel9@sha256:18bbf3f34bce5e82ca068c1a6709c03d76d0d3ac4bc182ba4c08f5b841752658_ppc64le |
| Red Hat | openshift4/ose-ptp-rhel9@sha256:1a61e9aa7483b98ca9acb1f9b091f74c392edfc0e6717510409caf359f7e66f9_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | *, openshift4/ose-ptp-rhel9@sha256:1a61e9aa7483b98ca9acb1f9b091f74c392edfc0e6717510409caf359f7e66f9_ppc64le, * |
| Red Hat | openshift4/ose-helm-operator@sha256:ff1a5e623c29c8991ae10fabd6c8eb3734f83ece62f4cf4bcf078467d5a77ea2_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-helm-operator@sha256:ff1a5e623c29c8991ae10fabd6c8eb3734f83ece62f4cf4bcf078467d5a77ea2_amd64, openshift4/ose-helm-operator@sha256:ff1a5e623c29c8991ae10fabd6c8eb3734f83ece62f4cf4bcf078467d5a77ea2_amd64, openshift4/ose-helm-operator@sha256:ff1a5e623c29c8991ae10fabd6c8eb3734f83ece62f4cf4bcf078467d5a77ea2_amd64 |
| Red Hat | openshift4/sriov-cni-rhel9@sha256:ed447e49cfc60e9c81fc9b1d30f34baf2108c5d70b68c6cc2ff58380e98eb72c_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/sriov-cni-rhel9@sha256:ed447e49cfc60e9c81fc9b1d30f34baf2108c5d70b68c6cc2ff58380e98eb72c_arm64, openshift4/sriov-cni-rhel9@sha256:ed447e49cfc60e9c81fc9b1d30f34baf2108c5d70b68c6cc2ff58380e98eb72c_arm64, openshift4/sriov-cni-rhel9@sha256:ed447e49cfc60e9c81fc9b1d30f34baf2108c5d70b68c6cc2ff58380e98eb72c_arm64 |
| Red Hat | openshift4/ose-node-feature-discovery-rhel9@sha256:0ade163c83507ac0c5cbf074622ec2336b43ef4f9193f7d5d3fb9f49f9c36398_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | *, openshift4/ose-node-feature-discovery-rhel9@sha256:0ade163c83507ac0c5cbf074622ec2336b43ef4f9193f7d5d3fb9f49f9c36398_ppc64le, * |
| Red Hat | openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:a770c24246133c818c313f39f006bfe57b86990a9acfbe36b9f9f4deb5a257fb_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:a770c24246133c818c313f39f006bfe57b86990a9acfbe36b9f9f4deb5a257fb_arm64, *, openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:a770c24246133c818c313f39f006bfe57b86990a9acfbe36b9f9f4deb5a257fb_arm64 |
| Red Hat | openshift4/ose-local-storage-rhel9-operator@sha256:f48565bf334c89e683f4715fe38599fd0929011f2d2ba16f8b6ed4a62e3fcde6_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-local-storage-rhel9-operator@sha256:f48565bf334c89e683f4715fe38599fd0929011f2d2ba16f8b6ed4a62e3fcde6_ppc64le, openshift4/ose-local-storage-rhel9-operator@sha256:f48565bf334c89e683f4715fe38599fd0929011f2d2ba16f8b6ed4a62e3fcde6_ppc64le, openshift4/ose-local-storage-rhel9-operator@sha256:f48565bf334c89e683f4715fe38599fd0929011f2d2ba16f8b6ed4a62e3fcde6_ppc64le |
| Red Hat | openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:4b553d1a78d1d200291069e53db8b2af4441e14ed3874e40bc22af47a9617fc5_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:4b553d1a78d1d200291069e53db8b2af4441e14ed3874e40bc22af47a9617fc5_s390x, *, * |
…and 290 more
Timeline
- Jul 2, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:4150 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2268046 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4150.json advisory
- https://access.redhat.com/security/cve/CVE-2024-24786 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-24786 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-24786 advisory
- https://go.dev/cl/569356 advisory
- https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/ advisory
- https://pkg.go.dev/vuln/GO-2024-2611 advisory