Red Hat Security AdvisoryRHSA-2023:7198
OpenShift Container Platform 4.15.0 bug fix and security update
Released 2024-02-27 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
Fixes 13 records
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 72
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02026 · Published 2023-11-10 · Partial fix · 0.46.0 CWE-770
Priority HIGH 72
goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00979 · Published 2023-07-18 · Partial fix · 0.0.0-20230731152917-f99041a5c027 CWE-400
Priority HIGH 70
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.93547 · Published 2023-12-18 · Partial fix · 0.40.2, 0.17.0 +2 CWE-354
Priority HIGH 65
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00797 · Published 2024-01-02 · Partial fix · 1.15.4 CWE-20
Priority MEDIUM 52
A path traversal vulnerability was discovered in go-git versions prior to v5.11.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0151 · Published 2024-01-12 · Partial fix · 5.11.0 CWE-22
Priority MEDIUM 41
Rekor is an open source software supply chain transparency log.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0105 · Published 2023-05-08 · Partial fix · 1.1.1 CWE-770
Priority MEDIUM 40
Alertmanager handles alerts sent by client applications such as the Prometheus server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00634 · Published 2023-08-25 · Fixed in 0.25.1 CWE-79
Priority LOW 39
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03796 · Published 2023-10-11 · Partial fix · 1.20.10, 1.21.3 +1 CWE-770
Priority LOW 36
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01614 · Published 2023-10-12 · Partial fix · 0.44.0 CWE-770
Priority LOW 35
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is n…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01137 · Published 2023-12-06 · Partial fix · 1.20.12, 1.21.5
Priority LOW 29
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00851 · Published 2023-08-02 · Partial fix · 0.13.0 CWE-79
Priority LOW 26
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01208 · Published 2023-12-06 · Partial fix · 1.20.12, 1.21.5
THREATIST.IORead the docs