Red Hat Updates OpenShift, Podman and RHACS to Prevent Sensitive URL Logging

Red Hat issued security updates across OpenShift Container Platform 4.13–4.16, Podman for RHEL 9, Red Hat Advanced Cluster Security 4.4.5, Cluster Observability Operator 0.4.1, and OpenShift Data Foundation 4.14 to remediate CVE-2024-6104. The flaw in go-retryablehttp can cause sensitive information contained in URLs to be written to log files, creating a risk of credential or token exposure to users and systems with log access. Affected OpenShift releases span RHEL 8 and RHEL 9 deployments on x86_64, aarch64, ppc64le, and s390x architectures.

Several advisories also fix related denial-of-service and input-validation flaws, including CVE-2024-37298 in gorilla/schema (memory exhaustion), CVE-2024-21538 in cross-spawn (regular-expression DoS), and defects in Go cryptography, protobuf JSON parsing, HAProxy, and other bundled components. Red Hat directs customers to update affected packages, container images, and clusters through supported release channels using the OpenShift web console or oc CLI, Red Hat package-update processes for Podman, and published image-update instructions for RHACS and Data Foundation.