Vulnerability-Lookup

RHSA-2024:0043

Vulnerability from csaf_redhat - Published: 2024-06-27 13:18 - Updated: 2026-10-15 05:18

Summary

Red Hat Security Advisory: Red Hat build of MicroShift 4.16.0 security update

Severity

Important

Notes

Topic: Red Hat build of MicroShift release 4.16.0 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge device deployments and is built from the edge capabilities of Red Hat OpenShift Container Platform. MicroShift is an application that is deployed on top of Red Hat Enterprise Linux devices at the edge, providing an efficient way to operate single-node clusters in these low-resource environments. This advisory contains the RPM packages for Red Hat build of MicroShift 4.16.0. Read the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2024:0041 All Red Hat build of MicroShift 4.16 users are advised to use these updated packages and images when they are available in the RPM repository. Security Fix(es): * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) * kubernetes: kube-apiserver: bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (CVE-2024-3177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-3177

A flaw was found in Kubernetes' kube-apiserver. This flaw allows authenticated users to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated.

2.7 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

CWE-213 - Exposure of Sensitive Information Due to Incompatible Policies

Affected products

Fixed 14 products

Product	Version	Remediation
Unresolved product id: 9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch	—	Vendor Fix fix
Unresolved product id: 9Base-RHOSE-4.16:microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch	—	Vendor Fix fix

Threats

Impact Low

CVE-2024-24786

A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by submitting specially crafted JSON payloads to cause excessive CPU utilization and hang the application, resulting in a Denial of Service (DoS).

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 14 products, the same list as for CVE-2024-3177

Threats

Impact Important

References

32 references

URL	Category
https://access.redhat.com/errata/RHSA-2024:0043	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2268046	external
https://bugzilla.redhat.com/show_bug.cgi?id=2274118	external
https://issues.redhat.com/browse/OCPBUGS-21901	external
https://issues.redhat.com/browse/OCPBUGS-23336	external
https://issues.redhat.com/browse/OCPBUGS-24444	external
https://issues.redhat.com/browse/OCPBUGS-24689	external
https://issues.redhat.com/browse/OCPBUGS-25030	external
https://issues.redhat.com/browse/OCPBUGS-25784	external
https://issues.redhat.com/browse/OCPBUGS-27849	external
https://issues.redhat.com/browse/OCPBUGS-29037	external
https://issues.redhat.com/browse/OCPBUGS-29847	external
https://issues.redhat.com/browse/OCPBUGS-30039	external
https://issues.redhat.com/browse/OCPBUGS-30807	external
https://issues.redhat.com/browse/OCPBUGS-30833	external
https://issues.redhat.com/browse/OCPBUGS-31739	external
https://issues.redhat.com/browse/OCPBUGS-32946	external
https://issues.redhat.com/browse/OCPBUGS-33588	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-3177	self
https://bugzilla.redhat.com/show_bug.cgi?id=2274118	external
https://www.cve.org/CVERecord?id=CVE-2024-3177	external
https://nvd.nist.gov/vuln/detail/CVE-2024-3177	external
https://discuss.kubernetes.io/t/security-advisory…	external
https://access.redhat.com/security/cve/CVE-2024-24786	self
https://bugzilla.redhat.com/show_bug.cgi?id=2268046	external
https://www.cve.org/CVERecord?id=CVE-2024-24786	external
https://nvd.nist.gov/vuln/detail/CVE-2024-24786	external
https://go.dev/cl/569356	external
https://groups.google.com/g/golang-announce/c/ArQ…	external
https://pkg.go.dev/vuln/GO-2024-2611	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat build of MicroShift release 4.16.0 is now available with updates to packages and images that include a security update.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of MicroShift is Red Hat\u0027s light-weight Kubernetes orchestration solution designed for edge device deployments and is built from the edge capabilities of Red Hat OpenShift Container Platform. MicroShift is an application that is deployed on top of Red Hat Enterprise Linux devices at the edge, providing an efficient way to operate single-node clusters in these low-resource environments.\n\nThis advisory contains the RPM packages for Red Hat build of MicroShift 4.16.0. Read the following advisory for the container images for this release:\n\nhttps://access.redhat.com/errata/RHSA-2024:0041\n\nAll Red Hat build of MicroShift 4.16 users are advised to use these updated packages and images when they are available in the RPM repository.\n\nSecurity Fix(es):\n\n* golang-protobuf: encoding/protojson, internal/encoding/json: infinite\nloop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON\n(CVE-2024-24786)\n* kubernetes: kube-apiserver: bypassing mountable secrets policy imposed by\nthe ServiceAccount admission plugin (CVE-2024-3177)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:0043",
        "url": "https://access.redhat.com/errata/RHSA-2024:0043"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2268046",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268046"
      },
      {
        "category": "external",
        "summary": "2274118",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274118"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-21901",
        "url": "https://issues.redhat.com/browse/OCPBUGS-21901"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-23336",
        "url": "https://issues.redhat.com/browse/OCPBUGS-23336"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-24444",
        "url": "https://issues.redhat.com/browse/OCPBUGS-24444"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-24689",
        "url": "https://issues.redhat.com/browse/OCPBUGS-24689"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-25030",
        "url": "https://issues.redhat.com/browse/OCPBUGS-25030"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-25784",
        "url": "https://issues.redhat.com/browse/OCPBUGS-25784"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-27849",
        "url": "https://issues.redhat.com/browse/OCPBUGS-27849"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-29037",
        "url": "https://issues.redhat.com/browse/OCPBUGS-29037"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-29847",
        "url": "https://issues.redhat.com/browse/OCPBUGS-29847"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-30039",
        "url": "https://issues.redhat.com/browse/OCPBUGS-30039"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-30807",
        "url": "https://issues.redhat.com/browse/OCPBUGS-30807"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-30833",
        "url": "https://issues.redhat.com/browse/OCPBUGS-30833"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-31739",
        "url": "https://issues.redhat.com/browse/OCPBUGS-31739"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-32946",
        "url": "https://issues.redhat.com/browse/OCPBUGS-32946"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-33588",
        "url": "https://issues.redhat.com/browse/OCPBUGS-33588"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0043.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of MicroShift 4.16.0 security update",
    "tracking": {
      "current_release_date": "2026-10-15T05:18:43+00:00",
      "generator": {
        "date": "2026-10-15T05:18:43+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2024:0043",
      "initial_release_date": "2024-06-27T13:18:33+00:00",
      "revision_history": [
        {
          "date": "2024-06-27T13:18:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-06-27T13:18:33+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-15T05:18:43+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.16",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.16",
                  "product_id": "9Base-RHOSE-4.16",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.16::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src",
                "product": {
                  "name": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src",
                  "product_id": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
                "product": {
                  "name": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
                  "product_id": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
                "product": {
                  "name": "microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
                  "product_id": "microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift-multus@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
                "product": {
                  "name": "microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
                  "product_id": "microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift-networking@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
                "product": {
                  "name": "microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
                  "product_id": "microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift-olm@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
                "product": {
                  "name": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
                  "product_id": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
                "product": {
                  "name": "microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
                  "product_id": "microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift-multus@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
                "product": {
                  "name": "microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
                  "product_id": "microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift-networking@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
                "product": {
                  "name": "microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
                  "product_id": "microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift-olm@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                "product": {
                  "name": "microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                  "product_id": "microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift-greenboot@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                "product": {
                  "name": "microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                  "product_id": "microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift-multus-release-info@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                "product": {
                  "name": "microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                  "product_id": "microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift-olm-release-info@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                "product": {
                  "name": "microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                  "product_id": "microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift-release-info@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                "product": {
                  "name": "microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                  "product_id": "microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microshift-selinux@4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64"
        },
        "product_reference": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src"
        },
        "product_reference": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64"
        },
        "product_reference": "microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch"
        },
        "product_reference": "microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64"
        },
        "product_reference": "microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64"
        },
        "product_reference": "microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch"
        },
        "product_reference": "microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64"
        },
        "product_reference": "microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64"
        },
        "product_reference": "microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64"
        },
        "product_reference": "microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64"
        },
        "product_reference": "microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch"
        },
        "product_reference": "microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch"
        },
        "product_reference": "microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch"
        },
        "product_reference": "microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-3177",
      "cwe": {
        "id": "CWE-213",
        "name": "Exposure of Sensitive Information Due to Incompatible Policies"
      },
      "discovery_date": "2024-04-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2274118"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Kubernetes\u0027 kube-apiserver. This flaw allows authenticated users to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kubernetes: kube-apiserver: bypassing mountable secrets policy imposed by the ServiceAccount admission plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Kubernetes clusters are only affected if the ServiceAccount admission plugin and the *kubernetes.io/enforce-mountable-secrets* annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
          "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src",
          "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
          "9Base-RHOSE-4.16:microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
          "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
          "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
          "9Base-RHOSE-4.16:microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
          "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
          "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
          "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
          "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
          "9Base-RHOSE-4.16:microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
          "9Base-RHOSE-4.16:microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
          "9Base-RHOSE-4.16:microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-3177"
        },
        {
          "category": "external",
          "summary": "RHBZ#2274118",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274118"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-3177",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-3177"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-3177",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3177"
        },
        {
          "category": "external",
          "summary": "https://discuss.kubernetes.io/t/security-advisory-cve-2024-3177-bypassing-mountable-secrets-policy-imposed-by-the-serviceaccount-admission-plugin/27905",
          "url": "https://discuss.kubernetes.io/t/security-advisory-cve-2024-3177-bypassing-mountable-secrets-policy-imposed-by-the-serviceaccount-admission-plugin/27905"
        }
      ],
      "release_date": "2024-04-16T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-06-27T13:18:33+00:00",
          "details": "For MicroShift 4.16, read the following documentation, which will be\nupdated shortly for this release, for important instructions on how to\ninstall the latest RPMs and fully apply this asynchronous errata update:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_build_of_microshift/4.16/html/release_notes/index",
          "product_ids": [
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src",
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:0043"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src",
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "kubernetes: kube-apiserver: bypassing mountable secrets policy imposed by the ServiceAccount admission plugin"
    },
    {
      "cve": "CVE-2024-24786",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2024-03-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2268046"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by submitting specially crafted JSON payloads to cause excessive CPU utilization and hang the application, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because exploitation is restricted to denial of service via excessive CPU and thread consumption, without compromising data confidentiality or system integrity. Red Hat services and containerized components are only exposed if they process untrusted JSON inputs into Protocol Buffer structures configured with specific parsing behaviors. Under typical deployments, the flaw does not grant privileged access or permit arbitrary code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
          "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src",
          "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
          "9Base-RHOSE-4.16:microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
          "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
          "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
          "9Base-RHOSE-4.16:microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
          "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
          "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
          "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
          "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
          "9Base-RHOSE-4.16:microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
          "9Base-RHOSE-4.16:microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
          "9Base-RHOSE-4.16:microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24786"
        },
        {
          "category": "external",
          "summary": "RHBZ#2268046",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268046"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24786",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24786"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24786",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24786"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/569356",
          "url": "https://go.dev/cl/569356"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/",
          "url": "https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-2611",
          "url": "https://pkg.go.dev/vuln/GO-2024-2611"
        }
      ],
      "release_date": "2024-03-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-06-27T13:18:33+00:00",
          "details": "For MicroShift 4.16, read the following documentation, which will be\nupdated shortly for this release, for important instructions on how to\ninstall the latest RPMs and fully apply this asynchronous errata update:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_build_of_microshift/4.16/html/release_notes/index",
          "product_ids": [
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src",
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:0043"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src",
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.src",
            "9Base-RHOSE-4.16:microshift-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-greenboot-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-multus-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-multus-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-networking-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.aarch64",
            "9Base-RHOSE-4.16:microshift-olm-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.x86_64",
            "9Base-RHOSE-4.16:microshift-olm-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-release-info-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch",
            "9Base-RHOSE-4.16:microshift-selinux-0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON"
    }
  ]
}

CVE-2024-24786 (GCVE-0-2024-24786)

Vulnerability from cvelistv5 – Published: 2024-03-05 22:22 – Updated: 2026-09-23 13:51

Title

Infinite loop in JSON unmarshaling in google.golang.org/protobuf

Summary

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-07 16:22 UTC

CWE

CWE-1286 - Improper Validation of Syntactic Correctness of Input

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

5 references

URL	Tags
https://go.dev/cl/569356
https://pkg.go.dev/vuln/GO-2024-2611
https://lists.fedoraproject.org/archives/list/pac…
http://www.openwall.com/lists/oss-security/2024/03/08/4
https://security.netapp.com/advisory/ntap-2024051…

Impacted products

2 products

Vendor	Product	Version
google.golang.org/protobuf	google.golang.org/protobuf/encoding/protojson	Affected: 0 , < 1.33.0 (semver)
google.golang.org/protobuf	google.golang.org/protobuf/internal/encoding/json	Affected: 0 , < 1.33.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-24786",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-07T16:22:27.828054Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T13:51:15.891Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:28:12.790Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/569356"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2611"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240517-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "google.golang.org/protobuf/encoding/protojson",
          "product": "google.golang.org/protobuf/encoding/protojson",
          "programRoutines": [
            {
              "name": "UnmarshalOptions.unmarshal"
            },
            {
              "name": "Unmarshal"
            },
            {
              "name": "UnmarshalOptions.Unmarshal"
            }
          ],
          "vendor": "google.golang.org/protobuf",
          "versions": [
            {
              "lessThan": "1.33.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "google.golang.org/protobuf/internal/encoding/json",
          "product": "google.golang.org/protobuf/internal/encoding/json",
          "programRoutines": [
            {
              "name": "Decoder.Read"
            },
            {
              "name": "Decoder.Peek"
            }
          ],
          "vendor": "google.golang.org/protobuf",
          "versions": [
            {
              "lessThan": "1.33.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-10T17:12:44.017Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/569356"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2611"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240517-0002/"
        }
      ],
      "title": "Infinite loop in JSON unmarshaling in google.golang.org/protobuf"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-24786",
    "datePublished": "2024-03-05T22:22:35.299Z",
    "dateReserved": "2024-01-30T16:05:14.757Z",
    "dateUpdated": "2026-09-23T13:51:15.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-3177 (GCVE-0-2024-3177)

Vulnerability from cvelistv5 – Published: 2024-04-22 23:00 – Updated: 2024-09-10 20:48

Title

Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin

Summary

A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.

Severity

2.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-23 00:12 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

kubernetes CNA under the mitre root

CNA scorecard – unranked: 2 records in the last 180 days, 10 needed details

References

5 references

URL	Tags
https://groups.google.com/g/kubernetes-security-a…	mailing-list
https://github.com/kubernetes/kubernetes/issues/124336	issue-tracking
https://lists.fedoraproject.org/archives/list/pac…	x_transferred
https://lists.fedoraproject.org/archives/list/pac…	x_transferred
http://www.openwall.com/lists/oss-security/2024/04/16/4	x_transferred

Impacted products

2 products

Vendor	Product	Version
Kubernetes	Kubernetes	Affected: 0 , ≤ 1.27.12 (semver) Affected: v1.28.0 - v1.28.8 Affected: v1.29.0 - v1.29.3
kubernetes	kubernetes	Affected: 1.29.0 cpe:2.3:a:kubernetes:kubernetes:-:::::::*

Date Public

2024-04-16 10:00

Credits

tha3e1vl

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:kubernetes:kubernetes:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "kubernetes",
            "vendor": "kubernetes",
            "versions": [
              {
                "status": "affected",
                "version": "1.29.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-3177",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-23T00:12:31.706727Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:03.250Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:05:07.568Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ"
          },
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://github.com/kubernetes/kubernetes/issues/124336"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WL54MTLGMTBZZO5PYGEGEBERTMADC4WC/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/16/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kubernetes",
          "vendor": "Kubernetes",
          "versions": [
            {
              "lessThanOrEqual": "1.27.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "v1.28.0 - v1.28.8"
            },
            {
              "status": "affected",
              "version": "v1.29.0 - v1.29.3"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "tha3e1vl"
        }
      ],
      "datePublic": "2024-04-16T10:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eA security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account\u2019s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.\u003c/div\u003e"
            }
          ],
          "value": "A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account\u2019s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-554",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-554 Functionality Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-10T20:48:09.780Z",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/kubernetes/kubernetes/issues/124336"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eTo mitigate this vulnerability, upgrade Kubernetes: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/\"\u003ehttps://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/\u003c/a\u003e\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "To mitigate this vulnerability, upgrade Kubernetes:  https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2024-3177",
    "datePublished": "2024-04-22T23:00:39.702Z",
    "dateReserved": "2024-04-01T23:49:13.716Z",
    "dateUpdated": "2024-09-10T20:48:09.780Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2024:0043

CVE-2024-24786 (GCVE-0-2024-24786)

CVE-2024-3177 (GCVE-0-2024-3177)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour