TI-2023-24278 CVE-2023-45288 · GHSA-4v7x-pqxf-cx7m
HTTP/2 CONTINUATION flood in net/http
Priority HIGH 81
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.
RHSA-2024:2729
Red Hat OpenStack Platform 17.1 (etcd) security update
Released 2024-05-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenStack Platform 17.1 etcd-3.4.26-8.el9ost
Fixes 5 records
TI-2024-01301 CVE-2024-1394 · GHSA-78hx-gp6g-7mj6
Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads
Priority LOW 36
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs.
TI-2023-24277 CVE-2023-45287 · GHSA-33qr-2xwr-95pw
Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Priority LOW 35
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time.
TI-2024-04128 CVE-2024-4438 · GHSA-5m7g-hw7h-q4qh
Etcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platform
Priority LOW 34
The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset.
TI-2023-20467 CVE-2023-39326 · GHSA-9f76-wg39-x86h
Denial of service via chunk extensions in net/http
Priority LOW 26
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body.