VDB
RHSA-2024:10518
RHSA-2024:10518
PUBLISHED
CVSS 6 MEDIUM
A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information.
Risk Scores
CVSS 3.1
6
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-kube-proxy-rhel9@sha256:aad67d775769f0aa3b8b33f178e30586fcb4f5d461a760c13f0c41ddfc1bd1d9_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-kube-proxy-rhel9@sha256:aad67d775769f0aa3b8b33f178e30586fcb4f5d461a760c13f0c41ddfc1bd1d9_ppc64le |
| Red Hat | openshift4/ose-service-ca-rhel9-operator@sha256:aadace8ef5eec2b808a0dc8fb6cd780b1bf9c5cd346ab95b97e5965de346fb19_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ovirt-csi-driver-rhel9-operator@sha256:a847d307d3e4cfdfeb1c31b9f6457c4475401a178738b7da4cf9c4e96e55c28e_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ose-cluster-samples-rhel9-operator@sha256:ddc73fc44fc78e8fefc82bc58900fa1d0c7f23068a1466ea64120e8d81d68c1f_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ose-operator-registry-rhel9@sha256:86bfb6c17e70a6bb404d5e0cfdf14bf2da4ca65c35c5b492cdb0a9badba4e0ac_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-operator-registry-rhel9@sha256:86bfb6c17e70a6bb404d5e0cfdf14bf2da4ca65c35c5b492cdb0a9badba4e0ac_ppc64le |
| Red Hat | openshift4/ose-cluster-authentication-rhel9-operator@sha256:3f9c86578808a8fcd23dcde4847ea84b580d8f12d9fdee62b8983df1e64904c6_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-cluster-authentication-rhel9-operator@sha256:3f9c86578808a8fcd23dcde4847ea84b580d8f12d9fdee62b8983df1e64904c6_arm64 |
| Red Hat | openshift4/ose-docker-registry-rhel9@sha256:526d11fb19f616850ff9b2b5b8a4780200c9d8d63cc43197d7c9ffcc30b3e004_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ose-csi-snapshot-controller-rhel9@sha256:5b7b1d5959c30918ef062e663b6bc61e3aec203155d54377c1fc6dd6defd7db6_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ose-hypershift-rhel9@sha256:9df8a8a04d1f66d882a9d4eef640ba82ef2e3f953a7440daa8045bb8409881a4_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ose-etcd-rhel9@sha256:1f28659c33ddcc568828e8ea85330808beb3ea9af1a9c747e3e8de52a478dede_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ose-csi-external-snapshotter-rhel9@sha256:9a1c9937b615677a9f780800fd1b61fc94b86f9e9b92356c9f1b0cf66470bc2c_s390x as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-csi-external-snapshotter-rhel9@sha256:9a1c9937b615677a9f780800fd1b61fc94b86f9e9b92356c9f1b0cf66470bc2c_s390x |
| Red Hat | openshift4/ovirt-csi-driver-rhel9@sha256:a35a901cfbe448fb86866d40461ed6ec19e94d28fc40221822caae22b97d83fd_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ose-cluster-api-rhel9@sha256:2949e82b3eeb6fb99b17d6b77496cd3647d50d76541cfdf4810b77afe7529008_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-cluster-api-rhel9@sha256:2949e82b3eeb6fb99b17d6b77496cd3647d50d76541cfdf4810b77afe7529008_amd64 |
| Red Hat | openshift4/ose-cluster-csi-snapshot-controller-rhel9-operator@sha256:b8be23eaa957eabec51d8df3c3cd297d651a0aa94f87bf376688ab98a9c6a0eb_s390x as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ose-multus-cni-rhel9@sha256:6c5e06a45899214a3eda4b5fd35a5c9503cf7314614186db4e5cf219052d6554_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ose-azure-workload-identity-webhook-rhel9@sha256:bc5abf457b5fad1e3f9450587352526bcd8eee8811304b52a093b0c5b52c6787_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ose-cluster-monitoring-rhel9-operator@sha256:86c4bdb4ad3ebee5d4bc94313ca35628ff3578c9c2cb128d1cead7388ccd0643_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-cluster-monitoring-rhel9-operator@sha256:86c4bdb4ad3ebee5d4bc94313ca35628ff3578c9c2cb128d1cead7388ccd0643_ppc64le |
| Red Hat | openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:d7cc88c0e373824c0b8405bb29dd44861a85973171082f8947c404d3edaebe0e_s390x as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ose-cluster-kube-storage-version-migrator-rhel9-operator@sha256:bb3d6fc04d6a6f19745520c586e2cb6a3da9e51296a26fda1ee8f5baeb15a7e9_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | openshift4/ose-cluster-etcd-rhel9-operator@sha256:d679398025727a62f8de0acf74205951aa497ba6af8c10f3b402bd39445e77f3_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-cluster-etcd-rhel9-operator@sha256:d679398025727a62f8de0acf74205951aa497ba6af8c10f3b402bd39445e77f3_arm64 |
…and 1304 more
Timeline
- Dec 3, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Aug 4, 2026 CVE Updated
- Aug 4, 2026 Distribution Patch
- Aug 4, 2026 Security Advisory
- Aug 4, 2026 Security Advisory
- Aug 4, 2026 Security Advisory
- Aug 4, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2024:10518 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2294000 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2302487 issue
- https://issues.redhat.com/browse/OCPBUGS-42752 advisory
- https://issues.redhat.com/browse/OCPBUGS-43047 advisory
- https://issues.redhat.com/browse/OCPBUGS-43454 advisory
- https://issues.redhat.com/browse/OCPBUGS-43795 advisory
- https://issues.redhat.com/browse/OCPBUGS-43800 advisory
- https://issues.redhat.com/browse/OCPBUGS-44190 advisory
- https://issues.redhat.com/browse/OCPBUGS-44830 advisory
- https://access.redhat.com/security/cve/CVE-2024-7409 advisory
- https://access.redhat.com/security/cve/CVE-2024-21538 advisory
- https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f advisory
- https://github.com/moxystudio/node-cross-spawn/pull/160 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2324291 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2324550 issue
- https://issues.redhat.com/browse/OCPBUGS-44183 advisory
- https://issues.redhat.com/browse/OCPBUGS-44611 advisory
- https://issues.redhat.com/browse/OCPBUGS-44699 advisory
…and 16 more