Red Hat Security AdvisoryRHSA-2023:3613
OpenShift Container Platform 4.12.22 packages and security update
Released 2023-06-26 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.12 bpftool-4.18.0-372.59.1.el8_6, buildah-1:1.23.4-5.1.rhaos4.12.el8, buildah-1:1.23.4-5.rhaos4.12.el9 +47
Fixes 7 records
Priority MEDIUM 43
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01841 · Published 2022-10-14 · Partial fix · 0.3.8 CWE-772
Priority LOW 39
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03487 · Published 2022-09-06 · Partial fix · 0.0.0-20220906165146-f3363e06e74c
Priority LOW 37
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02296 · Published 2022-09-13 · Partial fix · 1.19.1 CWE-22
Priority LOW 37
Reader.Read does not set a limit on the maximum size of file headers.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02006 · Published 2022-10-14 · Partial fix · 1.18.7, 1.19.2 CWE-770
Priority LOW 36
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01726 · Published 2022-10-14 · Partial fix · 1.18.7, 1.19.2
Priority LOW 36
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01408 · Published 2022-10-14 · Partial fix · 1.18.7, 1.19.2 CWE-444
Priority LOW 33
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container…
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00326 · Published 2022-09-13 · Partial fix · 4.2.0, 3.0.1 CWE-842
THREATIST.IORead the docs