VDB
RHSA-2024%3A4163
RHSA-2024%3A4163
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. This flaw allows an attacker to craft malicious input tailored to trigger the identified flaw in the unmarshal function. By providing carefully constructed invalid inputs, they could potentially cause the function to enter an infinite loop, resulting in a denial of service condition or other unintended behaviors in the affected system.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-gitops-1/gitops-rhel8-operator@sha256:2ebc3132162b1bb7cd2deedcda77552b2611e3cfb13d236d015bdd1aa5caadac_ppc64le as a component of Red Hat OpenShift GitOps 1.12 | *, openshift-gitops-1/gitops-rhel8-operator@sha256:2ebc3132162b1bb7cd2deedcda77552b2611e3cfb13d236d015bdd1aa5caadac_ppc64le, openshift-gitops-1/gitops-rhel8-operator@sha256:2ebc3132162b1bb7cd2deedcda77552b2611e3cfb13d236d015bdd1aa5caadac_ppc64le |
| Red Hat | openshift-gitops-1/argo-rollouts-rhel8@sha256:9a9553e940da983030f1d06b1a73afbbe69dd2afbaf35aca85d022786810891e_ppc64le as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/argo-rollouts-rhel8@sha256:9a9553e940da983030f1d06b1a73afbbe69dd2afbaf35aca85d022786810891e_ppc64le, openshift-gitops-1/argo-rollouts-rhel8@sha256:9a9553e940da983030f1d06b1a73afbbe69dd2afbaf35aca85d022786810891e_ppc64le, openshift-gitops-1/argo-rollouts-rhel8@sha256:9a9553e940da983030f1d06b1a73afbbe69dd2afbaf35aca85d022786810891e_ppc64le |
| Red Hat | openshift-gitops-1/dex-rhel8@sha256:ebb14930583daf011b306fabc9c67687c6ef263f17dd1a9095fabe52847a6425_amd64 as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/dex-rhel8@sha256:ebb14930583daf011b306fabc9c67687c6ef263f17dd1a9095fabe52847a6425_amd64, openshift-gitops-1/dex-rhel8@sha256:ebb14930583daf011b306fabc9c67687c6ef263f17dd1a9095fabe52847a6425_amd64, openshift-gitops-1/dex-rhel8@sha256:ebb14930583daf011b306fabc9c67687c6ef263f17dd1a9095fabe52847a6425_amd64 |
| Red Hat | openshift-gitops-1/gitops-rhel8-operator@sha256:2ebc3132162b1bb7cd2deedcda77552b2611e3cfb13d236d015bdd1aa5caadac_ppc64le as a component of Red Hat OpenShift GitOps 1.12 | *, openshift-gitops-1/gitops-rhel8-operator@sha256:2ebc3132162b1bb7cd2deedcda77552b2611e3cfb13d236d015bdd1aa5caadac_ppc64le, * |
| Red Hat | openshift-gitops-1/kam-delivery-rhel8@sha256:2d7e96f437a5c7ecdcdd1f6bdd1a9a9d512224aa1013d6f66e49146d0e5b39a0_ppc64le as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/kam-delivery-rhel8@sha256:2d7e96f437a5c7ecdcdd1f6bdd1a9a9d512224aa1013d6f66e49146d0e5b39a0_ppc64le, *, openshift-gitops-1/kam-delivery-rhel8@sha256:2d7e96f437a5c7ecdcdd1f6bdd1a9a9d512224aa1013d6f66e49146d0e5b39a0_ppc64le |
| Red Hat | openshift-gitops-1/gitops-rhel8@sha256:93f89ba5dc766ad377bbe00c44850b814deaa4e66c64c665fbee12433f41819c_amd64 as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/gitops-rhel8@sha256:93f89ba5dc766ad377bbe00c44850b814deaa4e66c64c665fbee12433f41819c_amd64, *, * |
| Red Hat | openshift-gitops-1/console-plugin-rhel8@sha256:d77164505154f55d8e67a2d90e7657b0ca6135bcb15458336bc50096f78eec5e_ppc64le as a component of Red Hat OpenShift GitOps 1.12 | *, openshift-gitops-1/console-plugin-rhel8@sha256:d77164505154f55d8e67a2d90e7657b0ca6135bcb15458336bc50096f78eec5e_ppc64le, openshift-gitops-1/console-plugin-rhel8@sha256:d77164505154f55d8e67a2d90e7657b0ca6135bcb15458336bc50096f78eec5e_ppc64le |
| Red Hat | openshift-gitops-1/gitops-operator-bundle@sha256:9bb74df8ca3491846b6df8313c96f99d58334c1bee8004f816777c39838ae54a_amd64 as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/gitops-operator-bundle@sha256:9bb74df8ca3491846b6df8313c96f99d58334c1bee8004f816777c39838ae54a_amd64, openshift-gitops-1/gitops-operator-bundle@sha256:9bb74df8ca3491846b6df8313c96f99d58334c1bee8004f816777c39838ae54a_amd64, openshift-gitops-1/gitops-operator-bundle@sha256:9bb74df8ca3491846b6df8313c96f99d58334c1bee8004f816777c39838ae54a_amd64 |
| Red Hat | openshift-gitops-1/must-gather-rhel8@sha256:d8df9c69adbce76ce6ef683685cf1d3bfb44d02c5cf84ba43d02cedc89b9de51_amd64 as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/must-gather-rhel8@sha256:d8df9c69adbce76ce6ef683685cf1d3bfb44d02c5cf84ba43d02cedc89b9de51_amd64, openshift-gitops-1/must-gather-rhel8@sha256:d8df9c69adbce76ce6ef683685cf1d3bfb44d02c5cf84ba43d02cedc89b9de51_amd64, openshift-gitops-1/must-gather-rhel8@sha256:d8df9c69adbce76ce6ef683685cf1d3bfb44d02c5cf84ba43d02cedc89b9de51_amd64 |
| Red Hat | openshift-gitops-1/argocd-rhel9@sha256:c89c5f5c91dfdc7fe821878c113bd49e3150eab70e6b6792b79e03b6159a1ba3_amd64 as a component of Red Hat OpenShift GitOps 1.12 | *, openshift-gitops-1/argocd-rhel9@sha256:c89c5f5c91dfdc7fe821878c113bd49e3150eab70e6b6792b79e03b6159a1ba3_amd64, openshift-gitops-1/argocd-rhel9@sha256:c89c5f5c91dfdc7fe821878c113bd49e3150eab70e6b6792b79e03b6159a1ba3_amd64 |
| Red Hat | openshift-gitops-1/must-gather-rhel8@sha256:e6a74044aa3f8d25ca5523faa6f803b5c38fda75b61f28116fac739484dee8f1_ppc64le as a component of Red Hat OpenShift GitOps 1.12 | *, openshift-gitops-1/must-gather-rhel8@sha256:e6a74044aa3f8d25ca5523faa6f803b5c38fda75b61f28116fac739484dee8f1_ppc64le, * |
| Red Hat | openshift-gitops-1/gitops-rhel8-operator@sha256:10b81029e3248a29f6d5197abb06d11224ce2473f5e37b1cbb3d7c0ecaa740da_arm64 as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/gitops-rhel8-operator@sha256:10b81029e3248a29f6d5197abb06d11224ce2473f5e37b1cbb3d7c0ecaa740da_arm64, openshift-gitops-1/gitops-rhel8-operator@sha256:10b81029e3248a29f6d5197abb06d11224ce2473f5e37b1cbb3d7c0ecaa740da_arm64, openshift-gitops-1/gitops-rhel8-operator@sha256:10b81029e3248a29f6d5197abb06d11224ce2473f5e37b1cbb3d7c0ecaa740da_arm64 |
| Red Hat | openshift-gitops-1/must-gather-rhel8@sha256:65c3c01e488bdde99ac3a7bd8010b98dc5e6e1982a10a7db124b1664afe03548_s390x as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/must-gather-rhel8@sha256:65c3c01e488bdde99ac3a7bd8010b98dc5e6e1982a10a7db124b1664afe03548_s390x, *, openshift-gitops-1/must-gather-rhel8@sha256:65c3c01e488bdde99ac3a7bd8010b98dc5e6e1982a10a7db124b1664afe03548_s390x |
| Red Hat | openshift-gitops-1/kam-delivery-rhel8@sha256:107fa77ba6a551e324fcf7339b3cedfe2a47a669a59adf4a6559d187ea723850_amd64 as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/kam-delivery-rhel8@sha256:107fa77ba6a551e324fcf7339b3cedfe2a47a669a59adf4a6559d187ea723850_amd64, *, openshift-gitops-1/kam-delivery-rhel8@sha256:107fa77ba6a551e324fcf7339b3cedfe2a47a669a59adf4a6559d187ea723850_amd64 |
| Red Hat | openshift-gitops-1/dex-rhel8@sha256:f8bc86210129a6175f03d583a8afa9fb119fce94151dfadbaa1e36c0b02c3272_arm64 as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/dex-rhel8@sha256:f8bc86210129a6175f03d583a8afa9fb119fce94151dfadbaa1e36c0b02c3272_arm64, openshift-gitops-1/dex-rhel8@sha256:f8bc86210129a6175f03d583a8afa9fb119fce94151dfadbaa1e36c0b02c3272_arm64, openshift-gitops-1/dex-rhel8@sha256:f8bc86210129a6175f03d583a8afa9fb119fce94151dfadbaa1e36c0b02c3272_arm64 |
| Red Hat | openshift-gitops-1/dex-rhel8@sha256:b300a9c26f0c00a7f90bb74877ab9b27fe8ff018a3cd2ad718be179cd96e651a_ppc64le as a component of Red Hat OpenShift GitOps 1.12 | *, openshift-gitops-1/dex-rhel8@sha256:b300a9c26f0c00a7f90bb74877ab9b27fe8ff018a3cd2ad718be179cd96e651a_ppc64le, openshift-gitops-1/dex-rhel8@sha256:b300a9c26f0c00a7f90bb74877ab9b27fe8ff018a3cd2ad718be179cd96e651a_ppc64le |
| Red Hat | openshift-gitops-1/argocd-rhel8@sha256:981f233c89dc451d6d4773888f3aeaf467856bfe4b6e599e1dc36ce949ff1e94_s390x as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/argocd-rhel8@sha256:981f233c89dc451d6d4773888f3aeaf467856bfe4b6e599e1dc36ce949ff1e94_s390x, *, openshift-gitops-1/argocd-rhel8@sha256:981f233c89dc451d6d4773888f3aeaf467856bfe4b6e599e1dc36ce949ff1e94_s390x |
| Red Hat | openshift-gitops-1/argocd-rhel9@sha256:e98f1849f7a3bb3642ef4974b3005780abe91a6542e96eb81745aa25fdebe8df_arm64 as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/argocd-rhel9@sha256:e98f1849f7a3bb3642ef4974b3005780abe91a6542e96eb81745aa25fdebe8df_arm64, openshift-gitops-1/argocd-rhel9@sha256:e98f1849f7a3bb3642ef4974b3005780abe91a6542e96eb81745aa25fdebe8df_arm64, * |
| Red Hat | openshift-gitops-1/argocd-rhel8@sha256:d88f18509bc4eba0e0b6e8c914f3c653a62d478ccddb836857da3dc250751537_ppc64le as a component of Red Hat OpenShift GitOps 1.12 | *, *, openshift-gitops-1/argocd-rhel8@sha256:d88f18509bc4eba0e0b6e8c914f3c653a62d478ccddb836857da3dc250751537_ppc64le |
| Red Hat | openshift-gitops-1/argo-rollouts-rhel8@sha256:aa3b1517f6b15456d6ca8796379aa9318fd349027ec05aa7bdc1123719b60f16_amd64 as a component of Red Hat OpenShift GitOps 1.12 | openshift-gitops-1/argo-rollouts-rhel8@sha256:aa3b1517f6b15456d6ca8796379aa9318fd349027ec05aa7bdc1123719b60f16_amd64, *, openshift-gitops-1/argo-rollouts-rhel8@sha256:aa3b1517f6b15456d6ca8796379aa9318fd349027ec05aa7bdc1123719b60f16_amd64 |
…and 50 more
Timeline
- Jun 27, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:4163 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2264336 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2265440 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2268046 issue
- https://issues.redhat.com/browse/GITOPS-4758 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4163.json advisory
- https://access.redhat.com/security/cve/CVE-2024-24786 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-24786 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-24786 advisory
- https://go.dev/cl/569356 advisory
- https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/ advisory
- https://pkg.go.dev/vuln/GO-2024-2611 advisory
- https://access.redhat.com/security/cve/CVE-2024-25620 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-25620 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-25620 advisory
- https://github.com/helm/helm/commit/0d0f91d1ce277b2c8766cdc4c7aa04dbafbf2503 advisory
- https://github.com/helm/helm/security/advisories/GHSA-v53g-5gjp-272r advisory
- https://access.redhat.com/security/cve/CVE-2024-26147 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-26147 advisory
…and 2 more