Red Hat Security Advisory

RHSA-2023:7710

Red Hat OpenShift for Windows Containers 7.2.0 security update

Released 2023-12-11 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.12 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel8-operator

Fixes 2 records

TI-2023-05086 CVE-2023-5528 · GHSA-hq6q-c2x6-hmch

Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation

HIGH 73

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04095 Published 2023-11-14 Fixed in v1.28.4, v1.27.8 +6 CWE-20

TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770