Red Hat Security AdvisoryRHSA-2024:1770
OpenShift Container Platform 4.15.9 bug fix and security update
Released 2024-04-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
Fixes 3 records
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority MEDIUM 63
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dep…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01027 · Published 2024-02-24 · Partial fix · 2.12.1 CWE-200
Priority LOW 39
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03796 · Published 2023-10-11 · Partial fix · 1.20.10, 1.21.3 +1 CWE-770
