Red Hat Security Advisory

RHSA-2023:6817

OpenShift Virtualization 4.14.0 Images security and bug fix update

Released 2023-11-08 · Red Hat rating Important · View on Red Hat →

Fixed in

CNV 4.14 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +37

Fixes 7 records

TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3

The HTTP/2 protocol allows a denial of service (server resource consumption) because…

CRITICAL 90KEV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99999 Published 2023-10-10 Partial fix · 1.28.0, 0.17.0 +9 CWE-400

TI-2023-10635 CVE-2023-25173 · GHSA-hmfx-3pcx-653p

containerd supplementary groups are not set up properly

HIGH 67

containerd is an open source container runtime.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00542 Published 2023-02-16 Partial fix · 1.5.18, 1.6.18 CWE-863

TI-2022-20116 CVE-2022-41725 · GHSA-w4h2-22wh-m6jx

Excessive resource consumption in mime/multipart

MEDIUM 41

A denial of service is possible from excessive resource consumption in net/http and mime/multipart.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01241 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 CWE-770

TI-2022-20115 CVE-2022-41724 · GHSA-89mw-w342-mqrr

Panic on large handshake records in crypto/tls

MEDIUM 41

Large handshake records may cause panics in crypto/tls.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01111 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 CWE-400

TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770

TI-2021-03617 CVE-2021-20329 · GHSA-f6mq-5m25-4r72

Specific cstrings input may not be properly validated in the Go Driver

LOW 32

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00935 Published 2021-06-10 Partial fix · 1.5.1 CWE-1287

TI-2023-10615 CVE-2023-25153 · GHSA-259w-8hf6-59c2

containerd OCI image importer memory exhaustion

LOW 28

containerd is an open source container runtime.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00363 Published 2023-02-16 Partial fix · 1.5.18, 1.6.18 CWE-770