Red Hat Security Advisory

RHSA-2023:3537

OpenShift Container Platform 4.13.3 bug fix and security update

Released 2023-06-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.13 openshift4/ose-aws-pod-identity-webhook-rhel8, openshift4/ose-azure-cloud-node-manager-rhel8, openshift4/ose-cloud-credential-operator +7

Fixes 3 records

TI-2023-10635 CVE-2023-25173 · GHSA-hmfx-3pcx-653p

containerd supplementary groups are not set up properly

HIGH 67

containerd is an open source container runtime.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00542 Published 2023-02-16 Partial fix · 1.5.18, 1.6.18 CWE-863

TI-2022-20114 CVE-2022-41723 · GHSA-vvpx-j8f3-3w6h

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

MEDIUM 46

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04561 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 +1 CWE-400

TI-2023-11287 CVE-2023-26054 · GHSA-gc89-7gcr-jxqc

Credentials inlined to Git URLs could end up in provenance attestation in BuildKit

LOW 31

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01026 Published 2023-03-06 Fixed in 0.11.4 CWE-200