Red Hat Security Advisory

RHSA-2023:5697

OpenShift Container Platform 4.11.52 bug fix and security update

Released 2023-10-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.11 openshift4/ose-docker-registry, openshift4/ose-hyperkube, openshift4/ose-pod

Fixes 2 records

TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770

TI-2023-02112 CVE-2023-2253 · GHSA-hqxw-f8mx-cpmw

Resource allocation without limits in distribution/distribution

LOW 31

A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00938 Published 2023-06-06 Partial fix · 2.8.2-beta.1 CWE-475