Red Hat Security AdvisoryRHSA-2023:3204
OpenShift Virtualization 4.13.0 RPMs security and bug fix update
Released 2023-05-18 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- CNV 4.13 for RHEL 7 kubevirt-4.13.0-1469.el7, kubevirt-virtctl-4.13.0-1469.el7, kubevirt-virtctl-redistributable-4.13.0-1469.el7
- CNV 4.13 for RHEL 8 kubevirt-4.13.0-1469.el8, kubevirt-virtctl-4.13.0-1469.el8, kubevirt-virtctl-redistributable-4.13.0-1469.el8
- CNV 4.13 for RHEL 9 kubevirt-4.13.0-1469.el9, kubevirt-virtctl-4.13.0-1469.el9, kubevirt-virtctl-redistributable-4.13.0-1469.el9
Fixes 5 records
Priority MEDIUM 44
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02781 · Published 2022-08-09 · Partial fix · 1.17.13, 1.18.5
Priority MEDIUM 43
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01841 · Published 2022-10-14 · Partial fix · 0.3.8 CWE-772
Priority LOW 39
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03487 · Published 2022-09-06 · Partial fix · 0.0.0-20220906165146-f3363e06e74c
Priority LOW 37
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02296 · Published 2022-09-13 · Partial fix · 1.19.1 CWE-22
Priority LOW 33
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.06077 · Published 2022-12-08 · Partial fix · 1.18.9, 1.19.4 +1 CWE-770
THREATIST.IORead the docs