Red Hat Security Advisory

RHSA-2024:0766

OpenShift Container Platform 4.15.0 security update

Released 2024-02-28 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.15 openshift4/ose-aws-efs-csi-driver-container-rhel8, openshift4/ose-aws-efs-csi-driver-rhel8-operator, openshift4/ose-ptp-rhel9-operator

Fixes 4 records

TI-2023-25448 CVE-2023-47108 · GHSA-8pgv-569h-w5rw

DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

HIGH 72

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02026 Published 2023-11-10 Partial fix · 0.46.0 CWE-770

TI-2023-26623 CVE-2023-48795 · GHSA-45x7-px36-x8w8

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6…

HIGH 70

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.93547 Published 2023-12-18 Partial fix · 0.40.2, 0.17.0 +2 CWE-354

TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770

TI-2023-24163 CVE-2023-45142 · GHSA-rcjv-mgp8-qvmr

OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

LOW 36

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01614 Published 2023-10-12 Partial fix · 0.44.0 CWE-770