Red Hat Security Advisory

RHSA-2023:4090

OpenShift Container Platform 4.13.5 security update

Released 2023-07-20 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.13 openshift4/ose-cluster-nfd-operator, openshift4/ose-node-feature-discovery

Fixes 2 records

TI-2022-20114 CVE-2022-41723 · GHSA-vvpx-j8f3-3w6h

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

MEDIUM 46

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04561 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 +1 CWE-400

TI-2022-20109 CVE-2022-41717 · GHSA-xrjj-mj9h-534m

Excessive memory growth in net/http and golang.org/x/net/http2

LOW 33

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.06077 Published 2022-12-08 Partial fix · 1.18.9, 1.19.4 +1 CWE-770