RHSA-2023:5006

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode.

goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

containerd is an open source container runtime.

The filename parameter of the Context.FileAttachment function is not properly sanitized.

Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3.

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Helm is a tool for managing Charts, pre-configured Kubernetes resources.

Helm is a tool for managing Charts, pre-configured Kubernetes resources.

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift.

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go.

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount.

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go.

A compliance problem was found in the Red Hat OpenShift Container Platform.

HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend.

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be.

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs.

A vulnerability was found in OpenShift OSIN.

An issue was discovered in Grafana Cortex through 1.9.0.

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks.