Red Hat Security Advisory

RHSA-2024:0843

Release of OpenShift Serverless 1.31.1

Released 2024-02-15 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat OpenShift Serverless 1.31 openshift-serverless-1-tech-preview/eventing-istio-controller-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-swf-builder-rhel8 +37

Fixes 5 records

TI-2023-26623 CVE-2023-48795 · GHSA-45x7-px36-x8w8

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6…

HIGH 70

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.93547 Published 2023-12-18 Partial fix · 0.40.2, 0.17.0 +2 CWE-354

TI-2023-27070 CVE-2023-49569 · GHSA-449p-3h89-pw88

Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

MEDIUM 52

A path traversal vulnerability was discovered in go-git versions prior to v5.11.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0151 Published 2024-01-12 Partial fix · 5.11.0 CWE-22

TI-2023-27069 CVE-2023-49568 · GHSA-mw99-9chc-xw7r

Maliciously crafted Git server replies can cause DoS on go-git clients

LOW 34

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00698 Published 2024-01-12 Partial fix · 5.11.0 CWE-20

TI-2023-05939 CVE-2023-6481 · GHSA-gm62-rw4g-vrc4

Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

LOW 34

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00682 Published 2023-12-04 Partial fix · 1.4.14, 1.3.14 +1

TI-2023-20467 CVE-2023-39326 · GHSA-9f76-wg39-x86h

Denial of service via chunk extensions in net/http

LOW 26

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01208 Published 2023-12-06 Partial fix · 1.20.12, 1.21.5