Red Hat Security Advisory

RHSA-2023:1268

OpenShift Container Platform 4.12.8 security update

Released 2023-03-21 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.12 haproxy-2.2.24-3.rhaos4.12.el8, haproxy22-2.2.24-3.rhaos4.12.el8, openshift-4.12.0-202303132316.p0.geab9cc9.assembly.stream.el8 +3

Fixes 2 records

TI-2023-10998 CVE-2023-25725 · GHSA-h2p2-w857-329f

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are…

MEDIUM 54

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names,…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05493 Published 2023-02-14 Partial fix CWE-444

TI-2022-20109 CVE-2022-41717 · GHSA-xrjj-mj9h-534m

Excessive memory growth in net/http and golang.org/x/net/http2

LOW 33

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.06077 Published 2022-12-08 Partial fix · 1.18.9, 1.19.4 +1 CWE-770