Red Hat Security Advisory

RHSA-2023:7315

OpenShift Container Platform 4.14.3 bug fix and security update

Released 2023-11-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.14 openshift4/ose-container-networking-plugins-rhel8, openshift4/ose-gcp-cluster-api-controllers-rhel8, openshift4/ose-k8s-prometheus-adapter +4

Fixes 3 records

TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3

The HTTP/2 protocol allows a denial of service (server resource consumption) because…

CRITICAL 90KEV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99999 Published 2023-10-10 Partial fix · 1.28.0, 0.17.0 +9 CWE-400

TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770

TI-2023-03693 CVE-2023-3978 · GHSA-2wrh-6pvc-2jm9

Improper rendering of text nodes in golang.org/x/net/html

LOW 29

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00851 Published 2023-08-02 Partial fix · 0.13.0 CWE-79