Red Hat Security AdvisoryRHSA-2023:5008
Red Hat build of MicroShift 4.14.0 security update
Released 2023-10-31 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.14 microshift-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-networking-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-release-info-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 +1
Fixes 7 records
Priority MEDIUM 42
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01345 · Published 2023-09-08 · Partial fix · 1.21.1 CWE-770
Priority MEDIUM 42
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01345 · Published 2023-09-08 · Partial fix · 1.21.1 CWE-400
Priority LOW 38
An authentication bypass vulnerability was discovered in kube-apiserver.
CVSS 3.1HIGH 8.0· Network · High privileges · No interaction · EPSS 0.01556 · Published 2023-09-24 · Fixed in 4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7, 4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8 +4 CWE-288
Priority LOW 35
Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.02157 · Published 2023-07-03 · Partial fix · 1.27.3, 1.26.6 +2 CWE-20
Priority LOW 33
Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.01134 · Published 2023-07-03 · Partial fix · 1.27.3, 1.26.6 +2 CWE-20
Priority LOW 29
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00911 · Published 2023-09-08 · Partial fix · 1.20.8, 1.21.1 CWE-79
Priority LOW 29
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0093 · Published 2023-09-08 · Partial fix · 1.20.8, 1.21.1 CWE-79
THREATIST.IORead the docs