RHSA-2023:6832

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18.

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service.

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets.

Templates containing actions in unquoted HTML attributes (e.g.

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be.

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method.

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values.