Red Hat Security Advisory

RHSA-2024:10813

OpenShift Container Platform 4.13.54 bug fix and security update

Released 2024-12-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.13 openshift4/ose-agent-installer-csr-approver-rhel8, openshift4/ose-cluster-samples-operator, openshift4/ose-console +1

Fixes 4 records

TI-2023-11349 CVE-2023-26125 · GHSA-3vp4-m3rf-835h

Improper input validation in github.com/gin-gonic/gin

HIGH 71

Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00905 Published 2023-05-04 Partial fix · 1.9.0 CWE-20

TI-2024-06036 CVE-2024-6508 · GHSA-4crf-28c7-v4gr

Openshift-console: oauth2 insufficient state parameter entropy

HIGH 70

An insufficient entropy vulnerability was found in the Openshift Console.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00673 Published 2024-08-21 Fixed in v4.12.0-202412201659.p0.g8910d84.assembly.stream.el8, v4.13.0-202411300029.p0.g68accd9.assembly.stream.el8 +167 CWE-331

TI-2024-06865 CVE-2024-7409 · GHSA-7c7g-wccp-rrhj

Qemu: denial of service via improper synchronization in qemu nbd server during socket closure

MEDIUM 41

A flaw was found in the QEMU NBD Server.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01027 Published 2024-08-05 Partial fix · 7.2.0, 8.2.0 +12 CWE-662

TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770