Red Hat Security AdvisoryRHSA-2023:1325
OpenShift Container Platform 4.13.0 security update
Released 2023-05-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Ironic content for Red Hat OpenShift Container Platform 4.13 python-werkzeug-2.0.3-4.el9, python3-werkzeug-2.0.3-4.el9
- Red Hat OpenShift Container Platform 4.13 buildah-1:1.29.1-1.rhaos4.13.el9, buildah-tests-1:1.29.1-1.rhaos4.13.el9, cri-o-1.26.3-3.rhaos4.13.git641290e.el9 +27
Fixes 13 records
Priority MEDIUM 54
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names,…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.05493 · Published 2023-02-14 · Partial fix CWE-444
Priority MEDIUM 46
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04561 · Published 2023-02-28 · Partial fix · 1.19.6, 1.20.1 +1 CWE-400
Priority MEDIUM 42
Werkzeug is a comprehensive WSGI web application library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0142 · Published 2023-02-14 · Partial fix · 2.2.3 CWE-770
Priority MEDIUM 42
A path traversal vulnerability exists in filepath.Clean on Windows.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01678 · Published 2023-02-28 · Partial fix · 1.19.6, 1.20.1 CWE-22
Priority MEDIUM 41
A denial of service is possible from excessive resource consumption in net/http and mime/multipart.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01241 · Published 2023-02-28 · Partial fix · 1.19.6, 1.20.1 CWE-770
Priority MEDIUM 41
Large handshake records may cause panics in crypto/tls.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01111 · Published 2023-02-28 · Partial fix · 1.19.6, 1.20.1 CWE-400
Priority MEDIUM 40
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03963 · Published 2022-03-18 · Partial fix · 0.0.0-20220314234659-1baeb1ce4c0b CWE-327
Priority LOW 35
Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00569 · Published 2022-12-09 · Fixed CWE-665
Priority LOW 33
A Time-of-check Time-of-use (TOCTOU) flaw was found in podman.
CVSS 3.1MEDIUM 6.8· Network · Low privileges · No interaction · EPSS 0.00541 · Published 2023-03-27 · Partial fix · 4.4.2 CWE-367
Priority LOW 33
An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01834 · Published 2023-03-23 · Partial fix CWE-400
Priority LOW 33
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.06077 · Published 2022-12-08 · Partial fix · 1.18.9, 1.19.4 +1 CWE-770
Priority LOW 31
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected containe…
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00353 · Published 2022-09-13 · Partial fix · 1.27.1 CWE-842
Priority LOW 29
A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined."…
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00665 · Published 2023-01-25 · Fixed in 0.0.0-20230120221150-cefee9e0162b CWE-20
THREATIST.IORead the docs