Red Hat Security AdvisoryRHSA-2023:4293
Migration Toolkit for Containers (MTC) 1.7.11 security and bug fix update
Released 2023-07-27 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8, rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8 +3
Fixes 5 records
Priority HIGH 71
Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading…
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00905 · Published 2023-05-04 · Partial fix · 1.9.0 CWE-20
Priority MEDIUM 53
The filename parameter of the Context.FileAttachment function is not properly sanitized.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00482 · Published 2023-06-08 · Partial fix · 1.9.1 CWE-494
Priority MEDIUM 46
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04561 · Published 2023-02-28 · Partial fix · 1.19.6, 1.20.1 +1 CWE-400
Priority LOW 34
Templates containing actions in unquoted HTML attributes (e.g.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.01037 · Published 2023-05-11 · Partial fix · 1.19.9, 1.20.4 CWE-94
Priority LOW 34
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.01037 · Published 2023-05-11 · Partial fix · 1.19.9, 1.20.4 CWE-94
THREATIST.IORead the docs