RHSA-2023:1326

A request smuggling attack is possible when using MaxBytesHandler.

containerd is an open source container runtime.

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources.

Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3.

Randomly-generated alphanumeric strings contain significantly less entropy than expected.

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing.

Prometheus Exporter Toolkit is a utility package to build exporters.

A denial of service is possible from excessive resource consumption in net/http and mime/multipart.

Large handshake records may cause panics in crypto/tls.

Helm is a tool for managing Charts, pre-configured Kubernetes resources.

Helm is a tool for managing Charts, pre-configured Kubernetes resources.

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount.

runc is a CLI tool for spawning and running containers according to the OCI specification.

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go.

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.

HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend.

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON.

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked i…

runc is a CLI tool for spawning and running containers according to the OCI specification.

Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes.

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks.