Red Hat Security Advisory

RHSA-2023:0709

Release of OpenShift Serverless 1.27.0

Released 2023-02-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Serverless 1.27 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8, openshift-serverless-1/client-kn-rhel8 +34

Fixes 4 records

TI-2022-10644 CVE-2022-27664 · GHSA-69cg-p879-7622

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of…

LOW 39

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03487 Published 2022-09-06 Partial fix · 0.0.0-20220906165146-f3363e06e74c

TI-2022-02669 CVE-2022-2879 · GHSA-fqpx-62jv-7r6r

Unbounded memory consumption when reading headers in archive/tar

LOW 37

Reader.Read does not set a limit on the maximum size of file headers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02006 Published 2022-10-14 Partial fix · 1.18.7, 1.19.2 CWE-770

TI-2022-20107 CVE-2022-41715 · GHSA-5wvm-rxcf-6cg8

Memory exhaustion when compiling regular expressions in regexp/syntax

LOW 36

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01726 Published 2022-10-14 Partial fix · 1.18.7, 1.19.2

TI-2022-02670 CVE-2022-2880 · GHSA-m3hq-grv6-h853

Incorrect sanitization of forwarded query parameters in net/http/httputil

LOW 36

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01408 Published 2022-10-14 Partial fix · 1.18.7, 1.19.2 CWE-444