Red Hat Security Advisory

RHSA-2023:0574

OpenShift Container Platform 4.9.55 security update

Released 2023-02-13 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.9 openshift4/ose-cluster-network-operator, openshift4/ose-etcd, openshift4/ose-grafana

Fixes 3 records

TI-2022-20253 CVE-2022-41912 · GHSA-j2jp-wvqg-wc2g

crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements

MEDIUM 53

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02337 Published 2022-11-28 Partial fix · 0.4.9 CWE-287

TI-2021-03097 CVE-2021-4238 · GHSA-xg2h-wx96-xgxr

Insufficient randomness in github.com/Masterminds/goutils

MEDIUM 50

Randomly-generated alphanumeric strings contain significantly less entropy than expected.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01408 Published 2022-12-27 Partial fix · 1.1.1 CWE-331

TI-2023-00281 CVE-2023-0296 · GHSA-wpff-vmpr-5q22

Broken or risky cryptographic algorithm in Red Hat OpenShift

LOW 30

The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0033 Published 2023-01-17 Fixed CWE-327