Walk/WalkDir in path/filepath susceptible to symlink race

red hat product security vex CVE-2024-8244 updated 2026-11-05 cvss 5.6

golang:path/filepath: Golang Walk/WalkDir symlink race

• Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-rhel9, rhai/assisted-installer-agent-rhel9, rhai/assisted-installer-controller-rhel9 Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-waiters-rhel9, openshift-builds/openshift-builds-webhook-rhel9, openshift-builds/openshift-builds-rhel9-operator, openshift-builds/openshift-builds-operator-bundle, openshift-builds/openshift-builds-controller-rhel9, openshift-builds/openshift-builds-git-cloner-rhel9, +4 more Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9, cert-manager/cert-manager-istio-csr-rhel9, cert-manager/jetstack-cert-manager-acmesolver-rhel9 Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-monitor-rhel9, openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-podvm-payload-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9, confidential-compute-attestation-tech-preview/trustee-rhel9-operator Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9, cryostat/cryostat-rhel9-operator, cryostat/cryostat-ose-oauth-proxy-rhel9, cryostat/cryostat-grafana-dashboard-rhel9 Red Hat Deployment Validation Operator dvo/deployment-validation-rhel8-operator

  +34 more productsfewer

  Red Hat external secrets operator for Red Hat OpenShift - Tech Preview external-secrets-operator/external-secrets-rhel9 Red Hat Fence Agents Remediation Operator workload-availability/fence-agents-remediation-rhel8-operator, workload-availability/fence-agents-remediation-operator-bundle Red Hat File Integrity Operator compliance/openshift-file-integrity-rhel8-operator, compliance/openshift-file-integrity-operator-bundle Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9, gatekeeper/gatekeeper-rhel9-operator Red Hat Kube Descheduler Operator kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-rhel9-operator Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9, openshift-logging/eventrouter-rhel8, openshift-logging/eventrouter-rhel9, openshift-logging/logging-loki-rhel9, openshift-logging/loki-rhel9-operator, openshift-logging/opa-openshift-rhel9, +6 more Red Hat Logical Volume Manager Storage lvms4/topolvm-rhel9, lvms4/lvms-rhel9-operator, lvms4/lvms-must-gather-rhel9 Red Hat Machine Deletion Remediation Operator workload-availability/machine-deletion-remediation-rhel8-operator, workload-availability/machine-deletion-remediation-operator-bundle Red Hat Migration Toolkit for Applications 7 mta/mta-cli-rhel9, mta/mta-hub-rhel9, mta/mta-analyzer-addon-rhel9, mta/mta-discovery-addon-rhel9, mta/mta-java-external-provider-rhel9, mta/mta-dotnet-external-provider-rhel8, +2 more Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-rsync-transfer-rhel8, rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-api-rhel9, migration-toolkit-virtualization/mtv-rhel8-operator, migration-toolkit-virtualization/mtv-rhel9-operator, migration-toolkit-virtualization/mtv-virt-v2v-rhel9, migration-toolkit-virtualization/mtv-controller-rhel9, migration-toolkit-virtualization/mtv-validation-rhel9, +7 more Red Hat mirror registry for Red Hat OpenShift openshift/mirror-registry-rhel8 Red Hat Multiarch Tuning Operator multiarch-tuning/multiarch-tuning-rhel9-operator Red Hat Multicluster Engine for Kubernetes multicluster-engine/hive-rhel8, multicluster-engine/hive-rhel9, multicluster-engine/work-rhel8, multicluster-engine/work-rhel9, multicluster-engine/discovery-rhel8, multicluster-engine/discovery-rhel9, +63 more Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-manager-rhel9, multicluster-globalhub/multicluster-globalhub-rhel9-operator, multicluster-globalhub/multicluster-globalhub-operator-bundle, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9, +1 more Red Hat NBDE Tang Server nbde-tang-server/nbde-tang-server-rhel9-operator Red Hat Network Observability Operator network-observability/network-observability-cli-rhel9, network-observability/network-observability-rhel9-operator, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel8-operator, workload-availability/node-healthcheck-operator-bundle Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator, workload-availability/node-maintenance-operator-bundle, container-native-virtualization/node-maintenance-operator Red Hat OpenShift API for Data Protection oadp/oadp-velero-rhel9, oadp/oadp-rhel9-operator, oadp/oadp-mustgather-rhel9, oadp/oadp-velero-plugin-rhel9, oadp/oadp-velero-plugin-for-aws-rhel9, oadp/oadp-velero-plugin-for-csi-rhel9, +5 more Red Hat OpenShift Developer Tools and Services helm, openshift4/ose-jenkins, ocp-tools-4/jenkins-rhel8, jenkins-agent-base-container, ocp-tools-4/jenkins-agent-base-rhel8, ocp-tools-4/jenkins-agent-base-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-rhel9-operator, openshift-lightspeed/lightspeed-operator-bundle, openshift-lightspeed-tech-preview/lightspeed-operator-bundle Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Run Once Duration Override Operator run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator Red Hat OpenShift Serverless kn-workflow-plugin, openshift-serverless-1/logic-rhel8-operator, openshift-serverless-1/kn-plugin-event-sender-rhel8, openshift-serverless-1/kn-plugin-func-func-util-rhel8, openshift-serverless-1-tech-preview/logic-rhel8-operator Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/pilot-rhel8, openshift-service-mesh/proxyv2-rhel8, openshift-service-mesh/proxyv2-rhel9, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/ratelimit-rhel8, +1 more Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/istio-must-gather-rhel9, +1 more Red Hat OpenShift Source-to-Image (S2I) source-to-image/source-to-image-rhel8 Red Hat Power monitoring for Red Hat OpenShift openshift-power-monitoring/kepler-rhel9, openshift-power-monitoring/power-monitoring-rhel9-operator Red Hat 3scale API Management Platform 2 rhcl-1/authorino-rhel9, rhcl-1/authorino-rhel9-operator, rhcl-1/authorino-operator-bundle, 3scale-amp2/3scale-rhel7-operator, 3scale-amp2/3scale-rhel9-operator, 3scale-amp2/3scale-operator-bundle, +7 more Red Hat Advanced Cluster Management for Kubernetes 2 flightctl, flightctl-agent, flightctl-selinux, rhacm2/subctl-rhel9, rhacm2/thanos-rhel9, rhacm2/acm-cli-rhel9, +59 more Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-db-rhel8, +4 more Red Hat AMQ Clients qpid-proton, python3-qpid-proton, python39-qpid-proton
  affected: workaround, no fix available “Fix deferred”

40 more affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf