Red Hat Security Advisory

RHSA-2023:7515

Red Hat OpenShift for Windows Containers 9.0.0 security update

Released 2023-11-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.14 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel9-operator, openshift4/windows-machine-config-operator-bundle

Fixes 3 records

TI-2023-03433 CVE-2023-3676 · GHSA-7fxm-f474-hf8w

Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

HIGH 73

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.13156 Published 2023-10-31 Fixed in v1.28.1, v1.27.5 +8 CWE-20

TI-2023-03674 CVE-2023-3955 · GHSA-q78c-gwqw-jcmc

Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

MEDIUM 47

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03776 Published 2023-10-31 Fixed in v1.28.1, v1.27.5 +8 CWE-20

TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770