net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE: CVE-2024-24790
Component: golang
CWE: CWE-115
Severity: Moderate
CVSS v3: 6.6/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2024-06-04T00:00:00+00:00

A flaw was found in the Go language standard library net/netip. The method Is*() (IsPrivate(), IsPublic(), etc) doesn't behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to control access to resources or data.

Statement: This CVE has been marked as moderate as for our products a network-based attack vector is simply impossible when it comes to golang code,apart from that as per CVE flaw analysis reported by golang, this only affects integrity and confidentiality and has no effect on availability, hence CVSS has been marked as such.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Red Hat Ansible Automation Platform
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
If you are using an earlier version of RHACS 4.4, you are advised to upgrade to this patch release 4.4.6.
If you are using an earlier version of RHACS 4.5, you are advised to upgrade to this patch release 4.5.5.
If you are using an earlier version of RHACS, you are advised to upgrade to release 4.6.
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html

For Red Hat OpenShift Logging 5.6, see the following instructions to apply this update:

https://docs.openshift.com/container-platform/4.11/logging/cluster-logging-upgrading.html
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:669170342e3ae3456b2eb00dd0c45cd817d62af310e0aa2bf214f1da65fae9d0

      (For s390x architecture)
      The image digest is sha256:6b1a8c2a2e8ef6a98ae429e11dc85f594f819ba7d3229800ce944c5b3f77d227

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:7235b8e139da4ba4c17c2b4b9864c05c93c5f55f7c2f561e7f9796c7e6589917

      (For s390x architecture)
      The image digest is sha256:04865553b69831321134ca4e61be8ad02548ccfd41a2941c09bf357d5120dbde

      (For ppc64le architecture)
      The image digest is sha256:471fc8ffaa8d14e5aff88b91dcf378291aec41ab524aa88a1562f4767bf57b62

      (For aarch64 architecture)
      The image digest is sha256:83ddfc54da02ab4f523d181c7e9eeb24b3deef3bf6da3052e6db894f246c7a99

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:883088e3e6efa7443b0ac28cd7682c2fdbda889b576edad626769bf956ac0858

      (For s390x architecture)
      The image digest is sha256:ed3773f137bb292cd8e2b5e8f33c659216e5eae53efd4f515df7b8b6cf8488fc

      (For ppc64le architecture)
      The image digest is sha256:b7eec1dc05c406eebbc27d99b084dfd276d60131e406d94c6f6efe2f60d0bb17

      (For aarch64 architecture)
      The image digest is sha256:60a9293af28a32a62181989ebf6706ac55a660b251de6bb9e58e5e9de58b1128

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:994e0e5355c10a38892591ad48a7fd4d41a8f1e4822ab288f703d1eb37e8ba30

      (For s390x architecture)
      The image digest is sha256:b0a4bc15c8af9e4925ce0137972c21fde4bc476a4c0c48464ed632fc30d42fdc

      (For ppc64le architecture)
      The image digest is sha256:d395f1136fdefcd2a830ed6e1ee284d737ddf7d84913336686ba6625d9761f50

      (For aarch64 architecture)
      The image digest is sha256:5119081ac1580de244c981650fbb3e2bd697638307b28f6002ae1af5c38b472d

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html
See the Red Hat OpenShift serverless 1.33 documentation at: 
https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1.33
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html/updating_red_hat_satellite/index
Before applying this update, make sure all previously released errata relevant to your system have been applied.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Ensuring that the binaries for Helm are available for use to the customers/users. Follow the instructions linked in the References section to download the binaries for Helm and use them.
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2789521

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2789521

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2789521

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html

For Red Hat OpenShift Logging 5.8, see the following instructions to apply this update:

https://docs.openshift.com/container-platform/4.13/logging/cluster-logging-upgrading.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

For Red Hat OpenShift Logging 5.9, see the following instructions to apply this update:

https://docs.openshift.com/container-platform/4.14/logging/cluster-logging-upgrading.html
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are:

      (For x86_64 architecture)
      The image digest is sha256:7a478e987f9f283f7a182080522d40768db50ad274caad8165a9b5e74ba38c43

      (For s390x architecture)
      The image digest is sha256:6c84cd13d6cc90038d11cee892b9398e6e49e78fc4caef06b7e589debab7f198

      (For ppc64le architecture)
      The image digest is sha256:e0ca664a081cc992abc2303d2cdafc08b0cb961d8c5f9fe2ff9e91bd41788809

      (For aarch64 architecture)
      The image digest is sha256:436f1c88a1dd46dc3a2f46ca6139dc998f013a28e7714ad59258e5f7ab7556d3

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:633d1d36e834a70baf666994ef375b9d1702bd1c54ab46f96c41223af9c2d150

      (For s390x architecture)
      The image digest is sha256:3acd5a5030ccf39daf86d1109c3aa00f1f48d5f62054a37c779e7c62178468ad

      (For ppc64le architecture)
      The image digest is sha256:0d92c8189470fa0031c85e8f77e24d780ab3da4313b6454e88ad3bec909f269b

      (For aarch64 architecture)
      The image digest is sha256:c853f47f5e8f8d8afb943f5a75757b6870c0b8bcf4507a1bbe4ad53e9ef3fdd6

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
Before applying this update, make sure all previously released errata relevant to your system have been applied.
Red Hat OpenShift Pipelines is a cloud-native, continuous integration and
continuous delivery (CI/CD) solution based on Kubernetes resources.
It uses Tekton building blocks to automate deployments across multiple
platforms by abstracting away the underlying implementation details.
Tekton introduces a number of standard custom resource definitions (CRDs)
for defining CI/CD pipelines that are portable across Kubernetes distributions.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.