VDB
RHSA-2024:4469
RHSA-2024:4469
PUBLISHED
CVSS 6 MEDIUM
A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information.
Risk Scores
CVSS 3.1
6
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-cluster-version-rhel9-operator@sha256:f1bf9a3fce2c5c9b6677ed8e5aaeb35d4baa632b3b23440bca494a04a3c87f27_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | openshift4/ose-csi-snapshot-controller-rhel9@sha256:9d0e4356b2ef927ce37dc4b5530b5d17e10e1bdea3f17d76ce2d08a1de5ab15c_s390x as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-csi-snapshot-controller-rhel9@sha256:9d0e4356b2ef927ce37dc4b5530b5d17e10e1bdea3f17d76ce2d08a1de5ab15c_s390x |
| Red Hat | openshift4/azure-kms-encryption-provider-rhel9@sha256:8920af697acaa1c0fa7e169d7b85caf80bdebb9fe4cb03bcae63704bbc85f2f1_s390x as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/azure-kms-encryption-provider-rhel9@sha256:8920af697acaa1c0fa7e169d7b85caf80bdebb9fe4cb03bcae63704bbc85f2f1_s390x |
| Red Hat | openshift4/ose-network-interface-bond-cni-rhel9@sha256:ee7f677597cbf91fb9ed9f39e17c226a7bae4414ee05670cd9e40d85ca5dc7c1_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | openshift4/ose-cluster-machine-approver-rhel9@sha256:8e434ea40914c83a9f332b9d106cdaad2d6012a906c5c984fe769029b7348f00_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | openshift4/ose-telemeter-rhel9@sha256:65e264c004c13215aba5f18b07547fb0cc59050f9c0741ce18d6acc6e1365c3e_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | openshift4/ose-vmware-vsphere-csi-driver-rhel9@sha256:a8a8396260d8a256455f909fd765bb83140235a86116ce5c22f699a6c9a1c84f_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | openshift4/ose-prometheus-config-reloader-rhel9@sha256:9574b6df77ccac3d88cd39ad6d51faf368ed447eaad32c72ba98e32640df5167_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | openshift4/ose-cluster-capi-rhel9-operator@sha256:ae678044607c913aa0ef55ee138e883d92d3b7e5aa38a9b47cdc5b3f574f1cc7_s390x as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-cluster-capi-rhel9-operator@sha256:ae678044607c913aa0ef55ee138e883d92d3b7e5aa38a9b47cdc5b3f574f1cc7_s390x |
| Red Hat | openshift4/ose-baremetal-rhel9-operator@sha256:a4df54ac34c167f204d3f7fe6d94dc319e4a3da9eeb239753c4aeb1e1ebfcce3_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-baremetal-rhel9-operator@sha256:a4df54ac34c167f204d3f7fe6d94dc319e4a3da9eeb239753c4aeb1e1ebfcce3_arm64 |
| Red Hat | openshift4/ose-cluster-policy-controller-rhel9@sha256:dd5ca5e0d5d3771e09fc2fc18ea0c3b895391299764bb96c3fe7b72f35e7d3e9_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | openshift4/ose-csi-driver-shared-resource-webhook-rhel9@sha256:6c448534b25498d9142bc603984cbc082ca0bd781ab74295256b66e2fcd6aee8_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-csi-driver-shared-resource-webhook-rhel9@sha256:6c448534b25498d9142bc603984cbc082ca0bd781ab74295256b66e2fcd6aee8_ppc64le |
| Red Hat | openshift4/ose-cloud-credential-rhel9-operator@sha256:0aafc5e855be2ad417ff92952ecaf1b118777149265dd8aba77bcb4a498a9bcd_s390x as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-cloud-credential-rhel9-operator@sha256:0aafc5e855be2ad417ff92952ecaf1b118777149265dd8aba77bcb4a498a9bcd_s390x |
| Red Hat | openshift4/ose-csi-driver-shared-resource-rhel9-operator@sha256:66ce6d32d558a35dc1bac68e09c07d35a2119160e1c63c6dfec7a9e8c93c3955_s390x as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-csi-driver-shared-resource-rhel9-operator@sha256:66ce6d32d558a35dc1bac68e09c07d35a2119160e1c63c6dfec7a9e8c93c3955_s390x |
| Red Hat | openshift4/ose-cluster-csi-snapshot-controller-rhel9-operator@sha256:a29e5fb842c7bfbb54ce0f9dc8e64811c7167852c45cd21efcf4b3a2dcf393a9_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | openshift4/ose-cluster-baremetal-operator-rhel9@sha256:1f5160359bc4388ca6e2a179e977c84701829e667f78d8d55e353a08d92da58a_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | openshift4/ose-cluster-baremetal-operator-rhel9@sha256:1f5160359bc4388ca6e2a179e977c84701829e667f78d8d55e353a08d92da58a_amd64 |
| Red Hat | openshift4/ose-cluster-monitoring-rhel9-operator@sha256:ede7fafd9f8249b4229c683b52e580f4a5ddb738282cc90a4c60aaae8b9843b9_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | openshift4/ose-cluster-openshift-apiserver-rhel9-operator@sha256:9f6f235ae9564283a05efbd1363a6f356d8d23db4ed12ed8228662fc126b3c77_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | openshift4/driver-toolkit-rhel9@sha256:e28959afa9309adffa44549e29b115ea4b1d9c04208d2bf2d43a49798b6acfee_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | openshift4/ose-agent-installer-csr-approver-rhel9@sha256:cc55e147541b25e2bee1fd47e0ec6a66970e149a7fae9b97e96718213375bc05_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
…and 1301 more
Timeline
- Jul 3, 2024 PoC Published
- Jul 16, 2024 CVE Published
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Aug 4, 2026 CVE Updated
- Aug 4, 2026 Distribution Patch
- Aug 4, 2026 Distribution Patch
- Aug 4, 2026 Security Advisory
References
- https://access.redhat.com/security/updates/classification/#important advisory
- https://issues.redhat.com/browse/OCPBUGS-35298 advisory
- https://issues.redhat.com/browse/OCPBUGS-35730 advisory
- https://issues.redhat.com/browse/OCPBUGS-35831 advisory
- https://issues.redhat.com/browse/OCPBUGS-36182 advisory
- https://issues.redhat.com/browse/OCPBUGS-36324 advisory
- https://issues.redhat.com/browse/OCPBUGS-36328 advisory
- https://issues.redhat.com/browse/OCPBUGS-36341 advisory
- https://issues.redhat.com/browse/OCPBUGS-36358 advisory
- https://issues.redhat.com/browse/OCPBUGS-36386 advisory
- https://issues.redhat.com/browse/OCPBUGS-36435 advisory
- https://issues.redhat.com/browse/OCPBUGS-36447 advisory
- https://issues.redhat.com/browse/OCPBUGS-36482 advisory
- https://issues.redhat.com/browse/OCPBUGS-36746 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-6104 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-6104 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-6387 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-6387 advisory
- https://santandersecurityresearch.github.io/blog/sshing_the_masses.html advisory
- https://access.redhat.com/errata/RHSA-2024:4469 advisory
…and 16 more