Red Hat Security Advisory

RHSA-2023:4421

OpenShift Virtualization 4.12.5 security and bug fix update

Released 2023-08-01 · Red Hat rating Important · View on Red Hat →

Fixed in

CNV 4.12 for RHEL 8 container-native-virtualization/bridge-marker, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cnv-containernetworking-plugins +40

Fixes 3 records

TI-2023-10161 CVE-2023-24540 · GHSA-7qhm-5mxq-x7vp

Improper handling of JavaScript whitespace in html/template

MEDIUM 52

Not all valid JavaScript whitespace characters are considered to be whitespace.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0156 Published 2023-05-11 Partial fix · 1.19.9, 1.20.4 CWE-77

TI-2022-20114 CVE-2022-41723 · GHSA-vvpx-j8f3-3w6h

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

MEDIUM 46

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04561 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 +1 CWE-400

TI-2023-02895 CVE-2023-3089 · GHSA-wj5p-x3cr-46w8

Ocp & fips mode

LOW 33

A compliance problem was found in the Red Hat OpenShift Container Platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0052 Published 2023-07-05 Partial fix · 4.12.0 CWE-693