Red Hat Security Advisory

RHSA-2023:7200

OpenShift Container Platform 4.15.z security update

Released 2024-02-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.15 microshift-4.15.0-202402260721.p0.g799289b.assembly.4.15.0.el9, microshift-greenboot-4.15.0-202402260721.p0.g799289b.assembly.4.15.0.el9, microshift-networking-4.15.0-202402260721.p0.g799289b.assembly.4.15.0.el9 +3

Fixes 3 records

TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770

TI-2023-24277 CVE-2023-45287 · GHSA-33qr-2xwr-95pw

Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

LOW 35

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0125 Published 2023-12-05 Partial fix · 1.20.0 CWE-203

TI-2023-20467 CVE-2023-39326 · GHSA-9f76-wg39-x86h

Denial of service via chunk extensions in net/http

LOW 26

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01208 Published 2023-12-06 Partial fix · 1.20.12, 1.21.5