Red Hat Security AdvisoryRHSA-2023:5009
OpenShift Container Platform 4.14.0 security update
Released 2023-10-31 · Red Hat rating Important · View on Red Hat →
Fixes 15 records
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 72
goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00979 · Published 2023-07-18 · Partial fix · 0.0.0-20230731152917-f99041a5c027 CWE-400
Priority MEDIUM 52
A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01334 · Published 2023-07-06 · Partial fix CWE-416
Priority MEDIUM 42
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01345 · Published 2023-09-08 · Partial fix · 1.21.1 CWE-770
Priority MEDIUM 42
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01345 · Published 2023-09-08 · Partial fix · 1.21.1 CWE-400
Priority LOW 39
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03796 · Published 2023-10-11 · Partial fix · 1.20.10, 1.21.3 +1 CWE-770
Priority LOW 39
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03487 · Published 2022-09-06 · Partial fix · 0.0.0-20220906165146-f3363e06e74c
Priority LOW 35
Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.02157 · Published 2023-07-03 · Partial fix · 1.27.3, 1.26.6 +2 CWE-20
Priority LOW 33
A compliance problem was found in the Red Hat OpenShift Container Platform.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0052 · Published 2023-07-05 · Partial fix · 4.12.0 CWE-693
Priority LOW 33
Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.01134 · Published 2023-07-03 · Partial fix · 1.27.3, 1.26.6 +2 CWE-20
Priority LOW 32
A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00994 · Published 2023-10-04 · Partial fix · 22.12.1, 22.03.3 +3 CWE-400
Priority LOW 29
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00911 · Published 2023-09-08 · Partial fix · 1.20.8, 1.21.1 CWE-79
Priority LOW 29
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0093 · Published 2023-09-08 · Partial fix · 1.20.8, 1.21.1 CWE-79
Priority LOW 29
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00851 · Published 2023-08-02 · Partial fix · 0.13.0 CWE-79
Priority LOW 27
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01601 · Published 2023-08-02 · Partial fix · 1.19.12, 1.20.7 +1 CWE-400
THREATIST.IORead the docs