Red Hat Security Advisory

RHSA-2023:5672

OpenShift Container Platform 4.13.17 bug fix and security update

Released 2023-10-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.13 openshift4/ose-cluster-machine-approver, openshift4/ose-hyperkube, openshift4/ose-ovn-kubernetes +2

Fixes 3 records

TI-2022-20114 CVE-2022-41723 · GHSA-vvpx-j8f3-3w6h

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

MEDIUM 46

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04561 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 +1 CWE-400

TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770

TI-2023-02955 CVE-2023-3153 · GHSA-qq9r-36hc-f769

Service monitor mac flow is not rate limited

LOW 32

A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00994 Published 2023-10-04 Partial fix · 22.12.1, 22.03.3 +3 CWE-400