Red Hat Security Advisory

RHSA-2024:4677

OpenShift Container Platform 4.12.61 bug fix and security update

Released 2024-07-25 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-operator-lifecycle-manager +1

Fixes 2 records

TI-2023-24278 CVE-2023-45288 · GHSA-4v7x-pqxf-cx7m

HTTP/2 CONTINUATION flood in net/http

HIGH 81

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.89455 Published 2024-04-04 Partial fix · 1.21.9, 1.22.2 +1 CWE-400

TI-2022-20114 CVE-2022-41723 · GHSA-vvpx-j8f3-3w6h

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

MEDIUM 46

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04561 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 +1 CWE-400