VDB
RHSA-2024%3A4626
RHSA-2024%3A4626
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. This flaw allows an attacker to craft malicious input tailored to trigger the identified flaw in the unmarshal function. By providing carefully constructed invalid inputs, they could potentially cause the function to enter an infinite loop, resulting in a denial of service condition or other unintended behaviors in the affected system.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-gitops-1/gitops-operator-bundle@sha256:9357bd76c40ce6d7fdf72075b7a8c0fac132017390cdc3864768947b48347b94_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/gitops-operator-bundle@sha256:9357bd76c40ce6d7fdf72075b7a8c0fac132017390cdc3864768947b48347b94_amd64, *, openshift-gitops-1/gitops-operator-bundle@sha256:9357bd76c40ce6d7fdf72075b7a8c0fac132017390cdc3864768947b48347b94_amd64 |
| Red Hat | openshift-gitops-1/console-plugin-rhel8@sha256:5beea6b8cdb9e06fb0fb7f92beaf02a9e9ba7b8794df8fc6eaa279c861c54c1f_ppc64le as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/console-plugin-rhel8@sha256:5beea6b8cdb9e06fb0fb7f92beaf02a9e9ba7b8794df8fc6eaa279c861c54c1f_ppc64le, openshift-gitops-1/console-plugin-rhel8@sha256:5beea6b8cdb9e06fb0fb7f92beaf02a9e9ba7b8794df8fc6eaa279c861c54c1f_ppc64le, openshift-gitops-1/console-plugin-rhel8@sha256:5beea6b8cdb9e06fb0fb7f92beaf02a9e9ba7b8794df8fc6eaa279c861c54c1f_ppc64le |
| Red Hat | openshift-gitops-1/must-gather-rhel8@sha256:c16fc42f75a4b260316ae29b0ede0417771c76b0313291a8fc54a5f2eb8cf68b_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/must-gather-rhel8@sha256:c16fc42f75a4b260316ae29b0ede0417771c76b0313291a8fc54a5f2eb8cf68b_amd64, openshift-gitops-1/must-gather-rhel8@sha256:c16fc42f75a4b260316ae29b0ede0417771c76b0313291a8fc54a5f2eb8cf68b_amd64, openshift-gitops-1/must-gather-rhel8@sha256:c16fc42f75a4b260316ae29b0ede0417771c76b0313291a8fc54a5f2eb8cf68b_amd64 |
| Red Hat | openshift-gitops-1/must-gather-rhel8@sha256:974db252e93173e2a2217fbff3c1a56aaa1411480a587a42d0c43275257d8809_arm64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/must-gather-rhel8@sha256:974db252e93173e2a2217fbff3c1a56aaa1411480a587a42d0c43275257d8809_arm64, *, * |
| Red Hat | openshift-gitops-1/kam-delivery-rhel8@sha256:2b017899750d3945e786f75a85c9b0876bb9ee637c9c10b3f269a5976120776c_amd64 as a component of Red Hat OpenShift GitOps 1.11 | *, *, openshift-gitops-1/kam-delivery-rhel8@sha256:2b017899750d3945e786f75a85c9b0876bb9ee637c9c10b3f269a5976120776c_amd64 |
| Red Hat | openshift-gitops-1/gitops-rhel8-operator@sha256:6bbc7f6e353d2d8cfcbcbb68472c97b6ff332c611780f645517a9d00937624f5_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/gitops-rhel8-operator@sha256:6bbc7f6e353d2d8cfcbcbb68472c97b6ff332c611780f645517a9d00937624f5_amd64, openshift-gitops-1/gitops-rhel8-operator@sha256:6bbc7f6e353d2d8cfcbcbb68472c97b6ff332c611780f645517a9d00937624f5_amd64, openshift-gitops-1/gitops-rhel8-operator@sha256:6bbc7f6e353d2d8cfcbcbb68472c97b6ff332c611780f645517a9d00937624f5_amd64 |
| Red Hat | openshift-gitops-1/gitops-rhel8-operator@sha256:ec259fd03d43f8c71dd136baa7058e038adc172ac41d9a0bda72d89075a2faca_arm64 as a component of Red Hat OpenShift GitOps 1.11 | *, openshift-gitops-1/gitops-rhel8-operator@sha256:ec259fd03d43f8c71dd136baa7058e038adc172ac41d9a0bda72d89075a2faca_arm64, openshift-gitops-1/gitops-rhel8-operator@sha256:ec259fd03d43f8c71dd136baa7058e038adc172ac41d9a0bda72d89075a2faca_arm64 |
| Red Hat | openshift-gitops-1/gitops-rhel8-operator@sha256:ec259fd03d43f8c71dd136baa7058e038adc172ac41d9a0bda72d89075a2faca_arm64 as a component of Red Hat OpenShift GitOps 1.11 | *, *, * |
| Red Hat | openshift-gitops-1/dex-rhel8@sha256:a9f2a4c1d771f91ed46acd849a2957fb984eecf2036d9b9c84f72847e1079d78_s390x as a component of Red Hat OpenShift GitOps 1.11 | *, *, openshift-gitops-1/dex-rhel8@sha256:a9f2a4c1d771f91ed46acd849a2957fb984eecf2036d9b9c84f72847e1079d78_s390x |
| Red Hat | openshift-gitops-1/argocd-rhel8@sha256:f10e4081655abf6e5c99ad32000fe98f06299cbe55434908d3161d072fde2c20_s390x as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/argocd-rhel8@sha256:f10e4081655abf6e5c99ad32000fe98f06299cbe55434908d3161d072fde2c20_s390x, openshift-gitops-1/argocd-rhel8@sha256:f10e4081655abf6e5c99ad32000fe98f06299cbe55434908d3161d072fde2c20_s390x, openshift-gitops-1/argocd-rhel8@sha256:f10e4081655abf6e5c99ad32000fe98f06299cbe55434908d3161d072fde2c20_s390x |
| Red Hat | openshift-gitops-1/gitops-rhel8-operator@sha256:6bbc7f6e353d2d8cfcbcbb68472c97b6ff332c611780f645517a9d00937624f5_amd64 as a component of Red Hat OpenShift GitOps 1.11 | *, openshift-gitops-1/gitops-rhel8-operator@sha256:6bbc7f6e353d2d8cfcbcbb68472c97b6ff332c611780f645517a9d00937624f5_amd64, openshift-gitops-1/gitops-rhel8-operator@sha256:6bbc7f6e353d2d8cfcbcbb68472c97b6ff332c611780f645517a9d00937624f5_amd64 |
| Red Hat | openshift-gitops-1/dex-rhel8@sha256:7a0eaaa28b1593222a089490bbe785519bad33dc1169982fbd54d3c971589409_arm64 as a component of Red Hat OpenShift GitOps 1.11 | *, *, * |
| Red Hat | openshift-gitops-1/console-plugin-rhel8@sha256:f9f4c3dc50ed732bd52ca77cd81adf56228772ace9792bbd8ac72714282db5ea_s390x as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/console-plugin-rhel8@sha256:f9f4c3dc50ed732bd52ca77cd81adf56228772ace9792bbd8ac72714282db5ea_s390x, openshift-gitops-1/console-plugin-rhel8@sha256:f9f4c3dc50ed732bd52ca77cd81adf56228772ace9792bbd8ac72714282db5ea_s390x, openshift-gitops-1/console-plugin-rhel8@sha256:f9f4c3dc50ed732bd52ca77cd81adf56228772ace9792bbd8ac72714282db5ea_s390x |
| Red Hat | openshift-gitops-1/argocd-rhel8@sha256:b2fbdc3c9926b23f7e8506ad6a7062e6ca326bb3b69984762f7e4f29b1f4f93c_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/argocd-rhel8@sha256:b2fbdc3c9926b23f7e8506ad6a7062e6ca326bb3b69984762f7e4f29b1f4f93c_amd64, *, openshift-gitops-1/argocd-rhel8@sha256:b2fbdc3c9926b23f7e8506ad6a7062e6ca326bb3b69984762f7e4f29b1f4f93c_amd64 |
| Red Hat | openshift-gitops-1/argo-rollouts-rhel8@sha256:076add1204be36717a4f21320e25a1ef8f362b898a91860101e036585bd7e75e_arm64 as a component of Red Hat OpenShift GitOps 1.11 | *, openshift-gitops-1/argo-rollouts-rhel8@sha256:076add1204be36717a4f21320e25a1ef8f362b898a91860101e036585bd7e75e_arm64, openshift-gitops-1/argo-rollouts-rhel8@sha256:076add1204be36717a4f21320e25a1ef8f362b898a91860101e036585bd7e75e_arm64 |
| Red Hat | openshift-gitops-1/console-plugin-rhel8@sha256:98de5f96397f94c776a44554da00e80fee544a424404b4b64e91c65f6e463c5d_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/console-plugin-rhel8@sha256:98de5f96397f94c776a44554da00e80fee544a424404b4b64e91c65f6e463c5d_amd64, openshift-gitops-1/console-plugin-rhel8@sha256:98de5f96397f94c776a44554da00e80fee544a424404b4b64e91c65f6e463c5d_amd64, openshift-gitops-1/console-plugin-rhel8@sha256:98de5f96397f94c776a44554da00e80fee544a424404b4b64e91c65f6e463c5d_amd64 |
| Red Hat | openshift-gitops-1/kam-delivery-rhel8@sha256:2b017899750d3945e786f75a85c9b0876bb9ee637c9c10b3f269a5976120776c_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/kam-delivery-rhel8@sha256:2b017899750d3945e786f75a85c9b0876bb9ee637c9c10b3f269a5976120776c_amd64, openshift-gitops-1/kam-delivery-rhel8@sha256:2b017899750d3945e786f75a85c9b0876bb9ee637c9c10b3f269a5976120776c_amd64, openshift-gitops-1/kam-delivery-rhel8@sha256:2b017899750d3945e786f75a85c9b0876bb9ee637c9c10b3f269a5976120776c_amd64 |
| Red Hat | openshift-gitops-1/argo-rollouts-rhel8@sha256:9d59ac72c98079a9b29ed9a1ff5b39c49a804e28fb344112454c902000417090_ppc64le as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/argo-rollouts-rhel8@sha256:9d59ac72c98079a9b29ed9a1ff5b39c49a804e28fb344112454c902000417090_ppc64le, openshift-gitops-1/argo-rollouts-rhel8@sha256:9d59ac72c98079a9b29ed9a1ff5b39c49a804e28fb344112454c902000417090_ppc64le, openshift-gitops-1/argo-rollouts-rhel8@sha256:9d59ac72c98079a9b29ed9a1ff5b39c49a804e28fb344112454c902000417090_ppc64le |
| Red Hat | openshift-gitops-1/argocd-rhel8@sha256:af69609ef177ee3cea8ef04a056df8a4a422dbc83a2631781589b61c1ed6dea6_ppc64le as a component of Red Hat OpenShift GitOps 1.11 | *, *, * |
| Red Hat | openshift-gitops-1/must-gather-rhel8@sha256:bda0dc71e5e11fc3e30c3a1e164aecb9d0eacc5ce01b8b19a9d446d9a9271fd6_ppc64le as a component of Red Hat OpenShift GitOps 1.11 | *, *, * |
…and 46 more
Timeline
- Jul 18, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:4626 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2264336 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2265440 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2268046 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4626.json advisory
- https://access.redhat.com/security/cve/CVE-2024-24786 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-24786 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-24786 advisory
- https://go.dev/cl/569356 advisory
- https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/ advisory
- https://pkg.go.dev/vuln/GO-2024-2611 advisory
- https://access.redhat.com/security/cve/CVE-2024-25620 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-25620 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-25620 advisory
- https://github.com/helm/helm/commit/0d0f91d1ce277b2c8766cdc4c7aa04dbafbf2503 advisory
- https://github.com/helm/helm/security/advisories/GHSA-v53g-5gjp-272r advisory
- https://access.redhat.com/security/cve/CVE-2024-26147 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-26147 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-26147 advisory
…and 1 more