Red Hat Security Advisory

RHSA-2024:1891

OpenShift Container Platform 4.14.22 bug fix and security update

Released 2024-04-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47

Fixes 6 records

TI-2023-25448 CVE-2023-47108 · GHSA-8pgv-569h-w5rw

DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

HIGH 72

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02026 Published 2023-11-10 Partial fix · 0.46.0 CWE-770

TI-2023-27070 CVE-2023-49569 · GHSA-449p-3h89-pw88

Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

MEDIUM 52

A path traversal vulnerability was discovered in go-git versions prior to v5.11.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0151 Published 2024-01-12 Partial fix · 5.11.0 CWE-22

TI-2024-01056 CVE-2024-1139

Cluster-monitoring-operator: credentials leak

LOW 35

A credentials leak vulnerability was found in the cluster monitoring operator in OCP.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00892 Published 2024-04-25 Partial fix · v4.12.0-202405091536.p0.g8906207.assembly.stream.el8, v4.13.0-202404200313.p0.gb518881.assembly.stream.el8 +166 CWE-200

TI-2023-27069 CVE-2023-49568 · GHSA-mw99-9chc-xw7r

Maliciously crafted Git server replies can cause DoS on go-git clients

LOW 34

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00698 Published 2024-01-12 Partial fix · 5.11.0 CWE-20

TI-2024-01604 CVE-2024-1725 · GHSA-fg9q-5cw2-p6r9

Kubevirt-csi: persistentvolume allows access to hcp's root node

LOW 32

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00631 Published 2024-03-07 Fixed in v4.13.0-202404200313.p0.g9d909f7.assembly.stream.el8, v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8 +2 CWE-501

TI-2023-03693 CVE-2023-3978 · GHSA-2wrh-6pvc-2jm9

Improper rendering of text nodes in golang.org/x/net/html

LOW 29

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00851 Published 2023-08-02 Partial fix · 0.13.0 CWE-79