The following advisory data is extracted from:

https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8040.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff




====================================================================
Red Hat Security Advisory

Synopsis:           Moderate: Cluster Observability Operator 0.4.1
Advisory ID:        RHSA-2024:8040-03
Product:            Cluster Observability Operator
Advisory URL:       https://access.redhat.com/errata/RHSA-2024:8040
Issue date:         2024-10-14
Revision:           03
CVE Names:          CVE-2024-6104
====================================================================

Summary: 

The Cluster Observability Operator is a Kubernetes operator which enables the management of Monitoring/Alerting stacks through Kubernetes CRDs.




Description:

Cluster Observability Operator

Security Fix(es):

* coo-prometheus-container: go-retryablehttp: url might write sensitive information to log file [coo-0] (CVE-2024-6104)
* coo-thanos-container: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [coo-0] (CVE-2024-24786)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)listed in the References section.


Solution:

https://access.redhat.com/articles/11258



CVEs:

CVE-2024-6104

References:

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2268046
https://bugzilla.redhat.com/show_bug.cgi?id=2294000
https://issues.redhat.com/browse/COO-152
https://issues.redhat.com/browse/COO-220
https://issues.redhat.com/browse/COO-221
https://issues.redhat.com/browse/COO-353
https://issues.redhat.com/browse/COO-354
https://issues.redhat.com/browse/COO-356
https://issues.redhat.com/browse/COO-401
https://issues.redhat.com/browse/COO-402
https://issues.redhat.com/browse/COO-403
https://issues.redhat.com/browse/COO-404
https://issues.redhat.com/browse/COO-451