user may execute code on a developer's machine
CVE: CVE-2024-34069
Component: python-werkzeug
CWE: CWE-352
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-05-06T00:00:00+00:00

A flaw was found in Werkzeug, where an attacker may be able to execute code on a developer's machine under some circumstances. This issue requires the attacker to get the developer to interact with a domain and subdomain they control and enter the debugger PIN; if they are successful, it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger.

Statement: Werkzeug's debugger allows an attacker to potentially execute code on a developer's machine. This can occur if the attacker tricks the developer into interacting with a controlled domain and subdomain and entering the debugger PIN. Although the debugger is meant to run locally, successful exploitation can give the attacker access to it by guessing a specific URL that triggers the debugger. The severity is rate as IMPORTANT because this flaw can potentially impacts confidentiality, integrity, and availability if the attacker can gain control.

Ceph uses an affected Werkzeug version but this vulnerability does not impact OpenShift Data Foundation (ODF) because the debugger is not set up or used on development machines, so there is no debugger to have information taken from.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:4bc4925e8028158e3f313aa83e59e181c94d88b4aa82a3b00202d6f354e8dfed

      (For s390x architecture)
      The image digest is sha256:788a7a0fd2d808d1107d7ffc6731f799bdb8a41ac01ffab2afdbcb83b3390ffa

      (For ppc64le architecture)
      The image digest is sha256:f5c4474b162b3be7f693c51572d21dc5b1c8e14861049f2c426f4cce0a6bb4d8

      (For aarch64 architecture)
      The image digest is sha256:0bad0cf89c81b99f44e8db697ff63c8b1acf973dc57cf138eadfd7708844027e

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:994e0e5355c10a38892591ad48a7fd4d41a8f1e4822ab288f703d1eb37e8ba30

      (For s390x architecture)
      The image digest is sha256:b0a4bc15c8af9e4925ce0137972c21fde4bc476a4c0c48464ed632fc30d42fdc

      (For ppc64le architecture)
      The image digest is sha256:d395f1136fdefcd2a830ed6e1ee284d737ddf7d84913336686ba6625d9761f50

      (For aarch64 architecture)
      The image digest is sha256:5119081ac1580de244c981650fbb3e2bd697638307b28f6002ae1af5c38b472d

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2789521

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:0d365611e78c5306975753975419851183536354273a6340021f9b1cdd2a34c3

      (For s390x architecture)
      The image digest is sha256:97d964c6f8261715f085836a757e46aad4992b006f4151f48166c063099c3811

      (For ppc64le architecture)
      The image digest is sha256:2c6fee680d01deecead598d8b027e1345e0915c0f2a9a260ed3ae953a100de62

      (For aarch64 architecture)
      The image digest is sha256:035f90f1fade5e4346f79936a367573da59de007b943ec638f43241871d44f94

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.