rhsa-2024:4144
Vulnerability from csaf_redhat
Published
2024-06-26 19:30
Modified
2025-06-04 15:46
Summary
Red Hat Security Advisory: VolSync 0.9.2 for RHEL 9

Notes

Topic
VolSync v0.9.2 general availability release images provide the following: enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.
Details
VolSync v0.9.2 is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters. After deploying the VolSync operator, you can create and maintain copies of your persistent data. For more information about VolSync, see: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.10/html/business_continuity/business-cont-overview#volsync or the VolSync open source community website at: https://volsync.readthedocs.io/en/stable/. This advisory contains enhancements and updates to the VolSync container images. Security fix(es): * CVE-2024-24786 - golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "VolSync v0.9.2 general availability release images provide the following:\nenhancements, security fixes, and updated container images.\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "VolSync v0.9.2 is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters. After deploying\nthe VolSync operator, you can create and maintain copies of your persistent\ndata.\n\nFor more information about VolSync, see:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.10/html/business_continuity/business-cont-overview#volsync\n\nor the VolSync open source community website at:\nhttps://volsync.readthedocs.io/en/stable/.\n\nThis advisory contains enhancements and updates to the VolSync\ncontainer images.\n\nSecurity fix(es):\n* CVE-2024-24786 - golang-protobuf: encoding/protojson,\ninternal/encoding/json: infinite loop in protojson.Unmarshal when\nunmarshaling certain forms of invalid JSON",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:4144",
        "url": "https://access.redhat.com/errata/RHSA-2024:4144"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://issues.redhat.com/browse/ACM-12028",
        "url": "https://issues.redhat.com/browse/ACM-12028"
      },
      {
        "category": "external",
        "summary": "ACM-12021",
        "url": "https://issues.redhat.com/browse/ACM-12021"
      },
      {
        "category": "external",
        "summary": "ACM-11528",
        "url": "https://issues.redhat.com/browse/ACM-11528"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4144.json"
      }
    ],
    "title": "Red Hat Security Advisory: VolSync 0.9.2 for RHEL 9",
    "tracking": {
      "current_release_date": "2025-06-04T15:46:43+00:00",
      "generator": {
        "date": "2025-06-04T15:46:43+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.1"
        }
      },
      "id": "RHSA-2024:4144",
      "initial_release_date": "2024-06-26T19:30:29+00:00",
      "revision_history": [
        {
          "date": "2024-06-26T19:30:29+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-06-26T19:30:29+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-06-04T15:46:43+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9",
                "product": {
                  "name": "Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9",
                  "product_id": "9Base-RHACM-2.10",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:acm:2.10::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat ACM"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/volsync-rhel9@sha256:726600d4a3546fae942d324916b3f7fab64a1975a91882fe6b396bbb17dc4123_s390x",
                "product": {
                  "name": "rhacm2/volsync-rhel9@sha256:726600d4a3546fae942d324916b3f7fab64a1975a91882fe6b396bbb17dc4123_s390x",
                  "product_id": "rhacm2/volsync-rhel9@sha256:726600d4a3546fae942d324916b3f7fab64a1975a91882fe6b396bbb17dc4123_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-rhel9@sha256:726600d4a3546fae942d324916b3f7fab64a1975a91882fe6b396bbb17dc4123?arch=s390x\u0026repository_url=registry.redhat.io/rhacm2/volsync-rhel9\u0026tag=v0.9.2-8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/volsync-rhel9@sha256:35784c0c4a70c03f718c23c58d89b9c7f6e8d9174a225b3dec77bd932d35c044_amd64",
                "product": {
                  "name": "rhacm2/volsync-rhel9@sha256:35784c0c4a70c03f718c23c58d89b9c7f6e8d9174a225b3dec77bd932d35c044_amd64",
                  "product_id": "rhacm2/volsync-rhel9@sha256:35784c0c4a70c03f718c23c58d89b9c7f6e8d9174a225b3dec77bd932d35c044_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-rhel9@sha256:35784c0c4a70c03f718c23c58d89b9c7f6e8d9174a225b3dec77bd932d35c044?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/volsync-rhel9\u0026tag=v0.9.2-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-operator-bundle@sha256:5d9a416fa840df6cb4a48ba7d8cdd27346a1cdb67e9d4c74217f132da7f75bc3_amd64",
                "product": {
                  "name": "rhacm2/volsync-operator-bundle@sha256:5d9a416fa840df6cb4a48ba7d8cdd27346a1cdb67e9d4c74217f132da7f75bc3_amd64",
                  "product_id": "rhacm2/volsync-operator-bundle@sha256:5d9a416fa840df6cb4a48ba7d8cdd27346a1cdb67e9d4c74217f132da7f75bc3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-operator-bundle@sha256:5d9a416fa840df6cb4a48ba7d8cdd27346a1cdb67e9d4c74217f132da7f75bc3?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/volsync-operator-bundle\u0026tag=v0.9.2-9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/volsync-rhel9@sha256:9ed45e5df017bed78a8b3c2caf1187aa4ce271fff9b33f772496297931f49db8_ppc64le",
                "product": {
                  "name": "rhacm2/volsync-rhel9@sha256:9ed45e5df017bed78a8b3c2caf1187aa4ce271fff9b33f772496297931f49db8_ppc64le",
                  "product_id": "rhacm2/volsync-rhel9@sha256:9ed45e5df017bed78a8b3c2caf1187aa4ce271fff9b33f772496297931f49db8_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-rhel9@sha256:9ed45e5df017bed78a8b3c2caf1187aa4ce271fff9b33f772496297931f49db8?arch=ppc64le\u0026repository_url=registry.redhat.io/rhacm2/volsync-rhel9\u0026tag=v0.9.2-8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/volsync-rhel9@sha256:3199b133284a35ad0ababa39304b86185c99acf67ff33e6cbf6cf1117b4bfef9_arm64",
                "product": {
                  "name": "rhacm2/volsync-rhel9@sha256:3199b133284a35ad0ababa39304b86185c99acf67ff33e6cbf6cf1117b4bfef9_arm64",
                  "product_id": "rhacm2/volsync-rhel9@sha256:3199b133284a35ad0ababa39304b86185c99acf67ff33e6cbf6cf1117b4bfef9_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-rhel9@sha256:3199b133284a35ad0ababa39304b86185c99acf67ff33e6cbf6cf1117b4bfef9?arch=arm64\u0026repository_url=registry.redhat.io/rhacm2/volsync-rhel9\u0026tag=v0.9.2-8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-operator-bundle@sha256:5d9a416fa840df6cb4a48ba7d8cdd27346a1cdb67e9d4c74217f132da7f75bc3_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9",
          "product_id": "9Base-RHACM-2.10:rhacm2/volsync-operator-bundle@sha256:5d9a416fa840df6cb4a48ba7d8cdd27346a1cdb67e9d4c74217f132da7f75bc3_amd64"
        },
        "product_reference": "rhacm2/volsync-operator-bundle@sha256:5d9a416fa840df6cb4a48ba7d8cdd27346a1cdb67e9d4c74217f132da7f75bc3_amd64",
        "relates_to_product_reference": "9Base-RHACM-2.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel9@sha256:3199b133284a35ad0ababa39304b86185c99acf67ff33e6cbf6cf1117b4bfef9_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9",
          "product_id": "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:3199b133284a35ad0ababa39304b86185c99acf67ff33e6cbf6cf1117b4bfef9_arm64"
        },
        "product_reference": "rhacm2/volsync-rhel9@sha256:3199b133284a35ad0ababa39304b86185c99acf67ff33e6cbf6cf1117b4bfef9_arm64",
        "relates_to_product_reference": "9Base-RHACM-2.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel9@sha256:35784c0c4a70c03f718c23c58d89b9c7f6e8d9174a225b3dec77bd932d35c044_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9",
          "product_id": "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:35784c0c4a70c03f718c23c58d89b9c7f6e8d9174a225b3dec77bd932d35c044_amd64"
        },
        "product_reference": "rhacm2/volsync-rhel9@sha256:35784c0c4a70c03f718c23c58d89b9c7f6e8d9174a225b3dec77bd932d35c044_amd64",
        "relates_to_product_reference": "9Base-RHACM-2.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel9@sha256:726600d4a3546fae942d324916b3f7fab64a1975a91882fe6b396bbb17dc4123_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9",
          "product_id": "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:726600d4a3546fae942d324916b3f7fab64a1975a91882fe6b396bbb17dc4123_s390x"
        },
        "product_reference": "rhacm2/volsync-rhel9@sha256:726600d4a3546fae942d324916b3f7fab64a1975a91882fe6b396bbb17dc4123_s390x",
        "relates_to_product_reference": "9Base-RHACM-2.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel9@sha256:9ed45e5df017bed78a8b3c2caf1187aa4ce271fff9b33f772496297931f49db8_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9",
          "product_id": "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:9ed45e5df017bed78a8b3c2caf1187aa4ce271fff9b33f772496297931f49db8_ppc64le"
        },
        "product_reference": "rhacm2/volsync-rhel9@sha256:9ed45e5df017bed78a8b3c2caf1187aa4ce271fff9b33f772496297931f49db8_ppc64le",
        "relates_to_product_reference": "9Base-RHACM-2.10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-22189",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-04-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2273513"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in quic-go. This issue may allow an attacker to trigger a denial of service by sending a large number of NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRE_CONNECTION_ID frame, but the attacker can prevent the receiver from sending out the vast majority of these RETIRE_CONNECTION_ID frames by selectively acknowledging received packets and collapsing the peers congestion window and by manipulating the peer\u0027s RTT estimate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "quic-go: memory exhaustion attack against QUIC\u0027s connection ID mechanism",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-770: Allocation of Resources Without Limits or Throttling vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe platform enforces hardening guidelines to apply the most restrictive settings required for operations, while baseline configurations maintain secure system and software states. A defense-in-depth monitoring strategy includes perimeter firewalls and endpoint protection services that detect excessive resource usage caused by malicious activity or system misconfigurations. In the event of exploitation, process isolation ensures workloads operate in separate environments, preventing any single process from overconsuming CPU or memory and degrading system performance.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHACM-2.10:rhacm2/volsync-operator-bundle@sha256:5d9a416fa840df6cb4a48ba7d8cdd27346a1cdb67e9d4c74217f132da7f75bc3_amd64",
          "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:3199b133284a35ad0ababa39304b86185c99acf67ff33e6cbf6cf1117b4bfef9_arm64",
          "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:35784c0c4a70c03f718c23c58d89b9c7f6e8d9174a225b3dec77bd932d35c044_amd64",
          "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:726600d4a3546fae942d324916b3f7fab64a1975a91882fe6b396bbb17dc4123_s390x",
          "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:9ed45e5df017bed78a8b3c2caf1187aa4ce271fff9b33f772496297931f49db8_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-22189"
        },
        {
          "category": "external",
          "summary": "RHBZ#2273513",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273513"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-22189",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-22189"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-22189",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22189"
        },
        {
          "category": "external",
          "summary": "https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c85ed47a",
          "url": "https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c85ed47a"
        },
        {
          "category": "external",
          "summary": "https://github.com/quic-go/quic-go/security/advisories/GHSA-c33x-xqrf-c478",
          "url": "https://github.com/quic-go/quic-go/security/advisories/GHSA-c33x-xqrf-c478"
        },
        {
          "category": "external",
          "summary": "https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-management",
          "url": "https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-management"
        }
      ],
      "release_date": "2024-04-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-06-26T19:30:29+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.10/html/business_continuity/business-cont-overview#volsync",
          "product_ids": [
            "9Base-RHACM-2.10:rhacm2/volsync-operator-bundle@sha256:5d9a416fa840df6cb4a48ba7d8cdd27346a1cdb67e9d4c74217f132da7f75bc3_amd64",
            "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:3199b133284a35ad0ababa39304b86185c99acf67ff33e6cbf6cf1117b4bfef9_arm64",
            "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:35784c0c4a70c03f718c23c58d89b9c7f6e8d9174a225b3dec77bd932d35c044_amd64",
            "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:726600d4a3546fae942d324916b3f7fab64a1975a91882fe6b396bbb17dc4123_s390x",
            "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:9ed45e5df017bed78a8b3c2caf1187aa4ce271fff9b33f772496297931f49db8_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:4144"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHACM-2.10:rhacm2/volsync-operator-bundle@sha256:5d9a416fa840df6cb4a48ba7d8cdd27346a1cdb67e9d4c74217f132da7f75bc3_amd64",
            "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:3199b133284a35ad0ababa39304b86185c99acf67ff33e6cbf6cf1117b4bfef9_arm64",
            "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:35784c0c4a70c03f718c23c58d89b9c7f6e8d9174a225b3dec77bd932d35c044_amd64",
            "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:726600d4a3546fae942d324916b3f7fab64a1975a91882fe6b396bbb17dc4123_s390x",
            "9Base-RHACM-2.10:rhacm2/volsync-rhel9@sha256:9ed45e5df017bed78a8b3c2caf1187aa4ce271fff9b33f772496297931f49db8_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "quic-go: memory exhaustion attack against QUIC\u0027s connection ID mechanism"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.