Read the docs
Red Hat Security Advisory

RHSA-2023:5007

OpenShift Container Platform 4.14.0 security update

Released 2023-10-31 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 5 records

TI-2022-20114 CVE-2022-41723 · GHSA-vvpx-j8f3-3w6h

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

Priority MEDIUM 46

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04561 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 +1 CWE-400
TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

Priority LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770
TI-2023-03693 CVE-2023-3978 · GHSA-2wrh-6pvc-2jm9

Improper rendering of text nodes in golang.org/x/net/html

Priority LOW 29

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00851 Published 2023-08-02 Partial fix · 0.13.0 CWE-79