TI-2023-10159 CVE-2023-24538 · GHSA-v4m2-x4rp-hv22
Backticks not treated as string delimiters in html/template
Priority MEDIUM 47
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.
RHSA-2023:4093
OpenShift Container Platform 4.13.5 security update
Released 2023-07-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.13 openshift-4.13.0-202307132344.p0.gf245ced.assembly.stream.el8, openshift-4.13.0-202307132344.p0.gf245ced.assembly.stream.el9, openshift-clients-4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8 +5
Fixes 8 records
TI-2023-01193 CVE-2023-1260 · GHSA-92hx-3mh6-hc49
Kube-apiserver: privesc
Priority LOW 38
An authentication bypass vulnerability was discovered in kube-apiserver.
TI-2023-10155 CVE-2023-24534 · GHSA-8v5j-pwr7-w5f8
Excessive memory allocation in net/http and net/textproto
Priority LOW 37
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service.
TI-2023-10158 CVE-2023-24537 · GHSA-fp86-2355-v99r
Infinite loop in parsing in go/scanner
Priority LOW 36
Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.
TI-2023-10157 CVE-2023-24536 · GHSA-9f7g-gqwh-jpf5
Excessive resource consumption in net/http, net/textproto and mime/multipart
Priority LOW 36
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts.
TI-2023-13780 CVE-2023-29400 · GHSA-c9hr-fvm9-7c49
Improper handling of empty HTML attributes in html/template
Priority LOW 34
Templates containing actions in unquoted HTML attributes (e.g.
TI-2023-10160 CVE-2023-24539 · GHSA-3q6h-q44p-xw88
Improper sanitization of CSS values in html/template
Priority LOW 34
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts.
TI-2023-02895 CVE-2023-3089 · GHSA-wj5p-x3cr-46w8
Ocp & fips mode
Priority LOW 33
A compliance problem was found in the Red Hat OpenShift Container Platform.