Chapter 1. Workload Availability for Red Hat OpenShift 24.4 release notes Workload Availability for Red Hat OpenShift version 24.4 is now available. 1.1. New features and enhancements No new features and enhancements were included in this release. This release can be installed from the 4.16-eus channel and will be supported according to the Extended Update Support policy of OpenShift Container Platform version 4.16. 1.2. Deprecated and removed features No features were deprecated and/or removed in this release. 1.3. Bug fixes Fence Agent command line option can lead to privilege escalation. ( ECOPROJECT-2004 ) Cause: A flaw (CVE-2024-5651) was found in fence agents that rely on SSH/Telnet. This flaw could be abused to obtain a Remote Code Execution (RCE) primitive by supplying an arbitrary command to execute in the --ssh-path/--telnet-path arguments. A low-privilege user, that is, a user with developer access, can create a specifically crafted FenceAgentsRemediation for a fence agent supporting --ssh-path/--telnet-path arguments to execute arbitrary commands on the operator's pod. Consequence: This RCE leads to a privilege escalation, first as the service account running the operator, and then to another service account with cluster-admin privileges. Fix: Fence agents that rely on SSH/Telnet were removed. Result: Creating a specifically crafted FenceAgentsRemediation can no longer lead to privilege escalation. Node Health Check (NHC) remains in a Remediating status with the RemediationSkipped event. ( ECOPROJECT-2057 ) Cause: NHC Operator v0.8.0 introduces a new feature which allows you to use multiple remediation templates of the same kind when escalating a remediation. In order to allow this, the remediation Custom Rescource's (CR) name no longer matches the node's name. However, this was not reflected in all instances. Consequence: Under some circumstances NHC sends false RemediationSkipped events for control plane nodes, misses clean up of remediation CRs, and misses sending metrics for long running remediations. Fix: NHC no longer relies on matching CR names and node names in all instances. Result: Remediation events, clean up of remediations CRs, and metrics for long running remediations all work as expected. Node Health Check (NHC) console plugin will not work with future versions of OpenShift Container Platform (OCP). ( ECOPROJECT-2078 ) Cause: NHC operator uses an old OCP console API. Consequence: The node remediation console plugin will no longer be activated on future versions of OCP. Fix: NHC operator should use a newer OCP console API. Result: The node remediation console plugin will continue to only work on future versions of OCP. 1.4. Technology preview features There are no new Technology preview features in this release. 1.5. Known issues No known issues were identified in this release. 1.6. Mapping the Workload Availability for Red Hat OpenShift release to the Operator releases The RHWA version numbers are based on the year and the iteration in that year. For example, 24.4 is the fourth release in 2024. The Operator version numbers follow semantic versioning. Table 1.1. Release Mapping Workload Availability Version Operator Version 24.4 [a] Fence Agents Remediation (FAR) Operator 0.4.1 Machine Deletion Remediation (MDR) Operator 0.3.1 Node Health Check (NHC) Operator 0.8.2 Node Maintenance Operator (NMO) 5.3.1 [a] This version only contains updated Release Notes. For the relevant documentation for this version, see the 24.3 documentation.

Commands: