Red Hat Security AdvisoryRHSA-2021:2705
Release of OpenShift Serverless 1.16.0
Released 2021-07-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenShift Serverless 1.16 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +27
Fixes 3 records
Priority LOW 39
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03464 · Published 2021-08-02 · Partial fix CWE-20
Priority LOW 38
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02474 · Published 2021-03-10 · Partial fix CWE-835
Priority LOW 33
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.03692 · Published 2021-05-27 · Partial fix · 0.0.0-20210428140749-89ef3d95e781 CWE-674
