The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_6755.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff




====================================================================
Red Hat Security Advisory

Synopsis:           Important: Red Hat OpenShift Data Foundation 4.16.2 security and bug fix update
Advisory ID:        RHSA-2024:6755-03
Product:            Red Hat OpenShift Data Foundation
Advisory URL:       https://access.redhat.com/errata/RHSA-2024:6755
Issue date:         2024-09-18
Revision:           03
CVE Names:          CVE-2024-6104
====================================================================

Summary: 

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.16.2 on Red Hat Enterprise Linux 9 from Red Hat Container Registry.




Description:

Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multi-cloud data management service with an
S3 compatible API.

Bug fixes:

* Previously, when the label on the node was empty, the mount would fail. With this fix, when the node label is empty, the node is not considered for `crush_location` mount option and as a result persistent volume claim (PVC) mounts successfully. (BZ#2303177)

* Previously, after the OpenShift Data Foundation upgrade, the backingstore was stuck with \"Connecting\" status. With this fix, the location of the `upgrade_bucket_policy` script is corrected. (BZ#2303414)

All users of Red Hat OpenShift Data Foundation are advised to upgrade to these updated images, which provide these bug fixes.


Solution:

https://access.redhat.com/articles/11258



CVEs:

CVE-2024-6104

References:

https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/cve/CVE-2024-6104
https://access.redhat.com/security/cve/CVE-2024-8421
https://access.redhat.com/security/cve/CVE-2024-24789
https://access.redhat.com/security/cve/CVE-2024-28176
https://access.redhat.com/security/cve/CVE-2024-28863
https://access.redhat.com/security/cve/CVE-2024-29180
https://access.redhat.com/security/cve/CVE-2024-37890
https://access.redhat.com/security/cve/CVE-2024-41818
https://bugzilla.redhat.com/show_bug.cgi?id=2266006
https://bugzilla.redhat.com/show_bug.cgi?id=2268820
https://bugzilla.redhat.com/show_bug.cgi?id=2270863
https://bugzilla.redhat.com/show_bug.cgi?id=2290526
https://bugzilla.redhat.com/show_bug.cgi?id=2290675
https://bugzilla.redhat.com/show_bug.cgi?id=2292668
https://bugzilla.redhat.com/show_bug.cgi?id=2292777
https://bugzilla.redhat.com/show_bug.cgi?id=2293200
https://bugzilla.redhat.com/show_bug.cgi?id=2294000
https://bugzilla.redhat.com/show_bug.cgi?id=2300022
https://bugzilla.redhat.com/show_bug.cgi?id=2300289
https://bugzilla.redhat.com/show_bug.cgi?id=2300332
https://bugzilla.redhat.com/show_bug.cgi?id=2300499
https://bugzilla.redhat.com/show_bug.cgi?id=2303177
https://bugzilla.redhat.com/show_bug.cgi?id=2303414
https://bugzilla.redhat.com/show_bug.cgi?id=2304074
https://bugzilla.redhat.com/show_bug.cgi?id=2309710
https://bugzilla.redhat.com/show_bug.cgi?id=2310210