VDB

RHSA-2024%3A5054

RHSA-2024%3A5054 PUBLISHED CVSS 5.900000095367432 MEDIUM

A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. This flaw allows an attacker to craft malicious input tailored to trigger the identified flaw in the unmarshal function. By providing carefully constructed invalid inputs, they could potentially cause the function to enter an infinite loop, resulting in a denial of service condition or other unintended behaviors in the affected system.

Risk Scores

CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatcontainer-native-virtualization/virt-operator-rhel9@sha256:dbcbd6d9a898c82a22cb49b25ecbf66943c82ca1f4b49f8f55870fc9cf707598_arm64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/virt-operator-rhel9@sha256:dbcbd6d9a898c82a22cb49b25ecbf66943c82ca1f4b49f8f55870fc9cf707598_arm64, container-native-virtualization/virt-operator-rhel9@sha256:dbcbd6d9a898c82a22cb49b25ecbf66943c82ca1f4b49f8f55870fc9cf707598_arm64, container-native-virtualization/virt-operator-rhel9@sha256:dbcbd6d9a898c82a22cb49b25ecbf66943c82ca1f4b49f8f55870fc9cf707598_arm64
Red Hatcontainer-native-virtualization/virtio-win-rhel9@sha256:ea5d472e62d8f25c6ec2c562e2c78aa80f06ff1189c90ee6b49343121bceb28a_amd64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/virtio-win-rhel9@sha256:ea5d472e62d8f25c6ec2c562e2c78aa80f06ff1189c90ee6b49343121bceb28a_amd64, container-native-virtualization/virtio-win-rhel9@sha256:ea5d472e62d8f25c6ec2c562e2c78aa80f06ff1189c90ee6b49343121bceb28a_amd64, container-native-virtualization/virtio-win-rhel9@sha256:ea5d472e62d8f25c6ec2c562e2c78aa80f06ff1189c90ee6b49343121bceb28a_amd64
Red Hatcontainer-native-virtualization/kubevirt-realtime-checkup-rhel9@sha256:7a1fb7f12d84d5b4038f5f4bb46368d76b8021a2ccf9dc6a444068d56356a035_arm64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/kubevirt-realtime-checkup-rhel9@sha256:7a1fb7f12d84d5b4038f5f4bb46368d76b8021a2ccf9dc6a444068d56356a035_arm64, container-native-virtualization/kubevirt-realtime-checkup-rhel9@sha256:7a1fb7f12d84d5b4038f5f4bb46368d76b8021a2ccf9dc6a444068d56356a035_arm64, *
Red Hatcontainer-native-virtualization/hostpath-csi-driver-rhel9@sha256:999ad3745db5c497de241d07a692941c90c7f87861cb6a12353866936bea6204_arm64 as a component of CNV 4.16 for RHEL 9*, *, *
Red Hatcontainer-native-virtualization/mtq-controller-rhel9@sha256:4d41e38c28d360f2bf900d3a52d081c380d82debc1f1d7d18fe135feffb07a64_arm64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/mtq-controller-rhel9@sha256:4d41e38c28d360f2bf900d3a52d081c380d82debc1f1d7d18fe135feffb07a64_arm64, *, *
Red Hatcontainer-native-virtualization/cluster-network-addons-operator-rhel9@sha256:a9caa05f7569b8d37e37955c2f6cf5d4a574578357a3dcce960fdf9433a610e2_amd64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:a9caa05f7569b8d37e37955c2f6cf5d4a574578357a3dcce960fdf9433a610e2_amd64, *, container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:a9caa05f7569b8d37e37955c2f6cf5d4a574578357a3dcce960fdf9433a610e2_amd64
Red Hatcontainer-native-virtualization/virt-cdi-apiserver-rhel9@sha256:7a2794684ce1a918849e445f68aa31649457d32a621ce1abb69a64e6399e41a9_arm64 as a component of CNV 4.16 for RHEL 9*, *, *
Red Hatcontainer-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d9efcc9dfe171c8ed2baf7a719e7288541720f146e62339bbcb0c73861f98f84_arm64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d9efcc9dfe171c8ed2baf7a719e7288541720f146e62339bbcb0c73861f98f84_arm64, container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d9efcc9dfe171c8ed2baf7a719e7288541720f146e62339bbcb0c73861f98f84_arm64, container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d9efcc9dfe171c8ed2baf7a719e7288541720f146e62339bbcb0c73861f98f84_arm64
Red Hatcontainer-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:8b522cbafc9253b5693eb70ddb4af30c71fe30e4d54044f7f1c01f67aa775b92_arm64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:8b522cbafc9253b5693eb70ddb4af30c71fe30e4d54044f7f1c01f67aa775b92_arm64, container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:8b522cbafc9253b5693eb70ddb4af30c71fe30e4d54044f7f1c01f67aa775b92_arm64, container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:8b522cbafc9253b5693eb70ddb4af30c71fe30e4d54044f7f1c01f67aa775b92_arm64
Red Hatcontainer-native-virtualization/kubevirt-dpdk-checkup-rhel9@sha256:f42737acde70dbfc44ad5a5c66935d1f9fe66f62de8b34b69925baebeb3fd1f9_amd64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/kubevirt-dpdk-checkup-rhel9@sha256:f42737acde70dbfc44ad5a5c66935d1f9fe66f62de8b34b69925baebeb3fd1f9_amd64, *, container-native-virtualization/kubevirt-dpdk-checkup-rhel9@sha256:f42737acde70dbfc44ad5a5c66935d1f9fe66f62de8b34b69925baebeb3fd1f9_amd64
Red Hatcontainer-native-virtualization/virt-artifacts-server-rhel9@sha256:57fb6b85944eb7905888aca1be9f65fffa263001bf80faa8ba66751b3653c2bb_arm64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/virt-artifacts-server-rhel9@sha256:57fb6b85944eb7905888aca1be9f65fffa263001bf80faa8ba66751b3653c2bb_arm64, container-native-virtualization/virt-artifacts-server-rhel9@sha256:57fb6b85944eb7905888aca1be9f65fffa263001bf80faa8ba66751b3653c2bb_arm64, container-native-virtualization/virt-artifacts-server-rhel9@sha256:57fb6b85944eb7905888aca1be9f65fffa263001bf80faa8ba66751b3653c2bb_arm64
Red Hatcontainer-native-virtualization/virt-cdi-controller-rhel9@sha256:af8c807a5b1ef4054999636ecd707470a077a9ec2a1219b6dcb0130382cc34a7_amd64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/virt-cdi-controller-rhel9@sha256:af8c807a5b1ef4054999636ecd707470a077a9ec2a1219b6dcb0130382cc34a7_amd64, container-native-virtualization/virt-cdi-controller-rhel9@sha256:af8c807a5b1ef4054999636ecd707470a077a9ec2a1219b6dcb0130382cc34a7_amd64, container-native-virtualization/virt-cdi-controller-rhel9@sha256:af8c807a5b1ef4054999636ecd707470a077a9ec2a1219b6dcb0130382cc34a7_amd64
Red Hatcontainer-native-virtualization/aaq-controller-rhel9@sha256:c6dd6c120d336563ec7bdec6b44e055ab71f6da06e2cde8e0325eea59e3b9b8e_arm64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/aaq-controller-rhel9@sha256:c6dd6c120d336563ec7bdec6b44e055ab71f6da06e2cde8e0325eea59e3b9b8e_arm64, container-native-virtualization/aaq-controller-rhel9@sha256:c6dd6c120d336563ec7bdec6b44e055ab71f6da06e2cde8e0325eea59e3b9b8e_arm64, container-native-virtualization/aaq-controller-rhel9@sha256:c6dd6c120d336563ec7bdec6b44e055ab71f6da06e2cde8e0325eea59e3b9b8e_arm64
Red Hatcontainer-native-virtualization/cnv-must-gather-rhel9@sha256:552c767b0db125264fdf3b63f713e1df40a38ed77f1efdbf20056ea49dbda038_arm64 as a component of CNV 4.16 for RHEL 9*, container-native-virtualization/cnv-must-gather-rhel9@sha256:552c767b0db125264fdf3b63f713e1df40a38ed77f1efdbf20056ea49dbda038_arm64, container-native-virtualization/cnv-must-gather-rhel9@sha256:552c767b0db125264fdf3b63f713e1df40a38ed77f1efdbf20056ea49dbda038_arm64
Red Hatcontainer-native-virtualization/virt-handler-rhel9@sha256:64d9ff116a20aeb445964242efe19e250dca3a1e3a256567e9c382835b3c5847_amd64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/virt-handler-rhel9@sha256:64d9ff116a20aeb445964242efe19e250dca3a1e3a256567e9c382835b3c5847_amd64, *, container-native-virtualization/virt-handler-rhel9@sha256:64d9ff116a20aeb445964242efe19e250dca3a1e3a256567e9c382835b3c5847_amd64
Red Hatcontainer-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9@sha256:59493b27ecf315d104664a769529953156c403e7a76bc0eadaf6077fdf945bcf_amd64 as a component of CNV 4.16 for RHEL 9*, *, container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9@sha256:59493b27ecf315d104664a769529953156c403e7a76bc0eadaf6077fdf945bcf_amd64
Red Hatcontainer-native-virtualization/virt-cdi-cloner-rhel9@sha256:5341653d9db0bb4bff9691681f33cde098bc8b3cb952cb5cdf42c527f0aa5e5f_amd64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/virt-cdi-cloner-rhel9@sha256:5341653d9db0bb4bff9691681f33cde098bc8b3cb952cb5cdf42c527f0aa5e5f_amd64, container-native-virtualization/virt-cdi-cloner-rhel9@sha256:5341653d9db0bb4bff9691681f33cde098bc8b3cb952cb5cdf42c527f0aa5e5f_amd64, container-native-virtualization/virt-cdi-cloner-rhel9@sha256:5341653d9db0bb4bff9691681f33cde098bc8b3cb952cb5cdf42c527f0aa5e5f_amd64
Red Hatcontainer-native-virtualization/aaq-server-rhel9@sha256:df44034602ab58f64e04e62c35f708837e15504bd1b828db6a084f83f9d475f9_amd64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/aaq-server-rhel9@sha256:df44034602ab58f64e04e62c35f708837e15504bd1b828db6a084f83f9d475f9_amd64, container-native-virtualization/aaq-server-rhel9@sha256:df44034602ab58f64e04e62c35f708837e15504bd1b828db6a084f83f9d475f9_amd64, container-native-virtualization/aaq-server-rhel9@sha256:df44034602ab58f64e04e62c35f708837e15504bd1b828db6a084f83f9d475f9_amd64
Red Hatcontainer-native-virtualization/kubevirt-ssp-operator-rhel9@sha256:9874efc97de0d5cbf68fa4e505f523c9a88e5b8286f53449412b1774b0b49ec0_amd64 as a component of CNV 4.16 for RHEL 9container-native-virtualization/kubevirt-ssp-operator-rhel9@sha256:9874efc97de0d5cbf68fa4e505f523c9a88e5b8286f53449412b1774b0b49ec0_amd64, *, container-native-virtualization/kubevirt-ssp-operator-rhel9@sha256:9874efc97de0d5cbf68fa4e505f523c9a88e5b8286f53449412b1774b0b49ec0_amd64
Red Hatcontainer-native-virtualization/virt-cdi-cloner-rhel9@sha256:57eac6812a13932612db841c21da5b016ac0849c0810eeff297bc4797d71e774_arm64 as a component of CNV 4.16 for RHEL 9*, container-native-virtualization/virt-cdi-cloner-rhel9@sha256:57eac6812a13932612db841c21da5b016ac0849c0810eeff297bc4797d71e774_arm64, container-native-virtualization/virt-cdi-cloner-rhel9@sha256:57eac6812a13932612db841c21da5b016ac0849c0810eeff297bc4797d71e774_arm64

…and 196 more

Timeline

  • Aug 6, 2024 CVE Published
  • Apr 25, 2026 Distribution Patch
  • Apr 25, 2026 Distribution Patch
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • May 16, 2026 CVE Updated

References

…and 16 more

Open in Interactive Console →
$ Console Community · 100/wk Open console ›