Red Hat Security AdvisoryRHSA-2024:2730
Red Hat OpenStack Platform 17.1 (collectd-sensubility) security update
Released 2024-05-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenStack Platform 17.1 collectd-sensubility-0.2.1-3.el9ost
Fixes 3 records
Priority LOW 36
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01533 · Published 2024-03-21 · Partial fix · 1.4.5-1.el8ap, 1.4.5-1.el9ap +91 CWE-401
Priority LOW 35
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0125 · Published 2023-12-05 · Partial fix · 1.20.0 CWE-203
Priority LOW 26
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01208 · Published 2023-12-06 · Partial fix · 1.20.12, 1.21.5
