Red Hat Security Advisory

RHSA-2023:7201

OpenShift Container Platform 4.15.0 packages and security update

Released 2024-02-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.15 buildah-1:1.29.1-20.2.rhaos4.15.el8, buildah-1:1.29.1-20.2.rhaos4.15.el9, buildah-tests-1:1.29.1-20.2.rhaos4.15.el8 +37

Fixes 4 records

TI-2023-26623 CVE-2023-48795 · GHSA-45x7-px36-x8w8

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6…

HIGH 70

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.93547 Published 2023-12-18 Partial fix · 0.40.2, 0.17.0 +2 CWE-354

TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770

TI-2023-24277 CVE-2023-45287 · GHSA-33qr-2xwr-95pw

Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

LOW 35

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0125 Published 2023-12-05 Partial fix · 1.20.0 CWE-203

TI-2023-20467 CVE-2023-39326 · GHSA-9f76-wg39-x86h

Denial of service via chunk extensions in net/http

LOW 26

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01208 Published 2023-12-06 Partial fix · 1.20.12, 1.21.5