Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update

Fixed packages 52

Vulnerabilities 13

• Critical 9.1
  CVE-2023-25725 Public exploit

  HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situati…

  haproxy haproxy haproxy Debian Ubuntu Azure Linux
  Feb 14, 2023
• High 7.5
  CVE-2022-27191

  golang.org/x/crypto/ssh Denial of service via crafted Signer

  The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

  go k3d k3d-proxy k3d-tools Debian Ubuntu Alpine Wolfi Go
  Mar 18, 2022
• High 7.5
  CVE-2022-41723

  Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

  A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 28, 2023
• High 7.5
  CVE-2023-25577

  Werkzeug may allow high resource usage when parsing multipart form data with many fields

  Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse an…

  pallets werkzeug kubeflow-pipelines-visualization-server werkzeug Debian Ubuntu Azure Linux Wolfi PyPI
  Feb 14, 2023
• High 7.4
  CVE-2022-3259

  Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.

  Dec 9, 2022
• High 7.1
  CVE-2022-2990

  Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification

  An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used t…

  buildah buildah golang-github-containers-buildah golang-github-containers-buildah Debian Ubuntu Azure Linux Alpine Go
  Sep 13, 2022
• Medium 6.8
  CVE-2023-0778

  Podman Time-of-check Time-of-use (TOCTOU) Race Condition

  A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

  cri-o podman podman github.com/containers/podman/v4 Debian Ubuntu Azure Linux Alpine Go
  Mar 27, 2023
• Medium 6.5
  CVE-2023-0056

  An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue …

  haproxy haproxy haproxy-3.2 haproxy-3.3 Debian Ubuntu Wolfi
  Mar 23, 2023
• Medium 6.3
  CVE-2023-0229

  github.com/openshift/apiserver-library-go Improper Input Validation vulnerability

  A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used i…

  github.com/openshift/apiserver-library-go Go
  Jan 25, 2023
• Medium 5.3
  CVE-2022-41717 Public exploit

  Excessive memory growth in net/http and golang.org/x/net/http2

  An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 8, 2022
• Unscored —
  CVE-2022-41722

  Path traversal on Windows in path/filepath

  A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute pa…

  Go standard library path/filepath katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Wolfi Go
  Feb 28, 2023
• Unscored —
  CVE-2022-41724

  Panic on large handshake records in crypto/tls

  Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 cli…

  Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 28, 2023
• Unscored —
  CVE-2022-41725

  Excessive resource consumption in mime/multipart

  A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in th…

  Go standard library mime/multipart katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 28, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2103220
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2121453
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2160349
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2160808
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161274
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2168256
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2169089
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170242
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178358
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178488
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178492
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1325.json
• report
  https://access.redhat.com/security/cve/CVE-2022-2990
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2990
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2990
• article
  https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
• report
  https://access.redhat.com/security/cve/CVE-2022-3259
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3259
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3259
• report
  https://access.redhat.com/security/cve/CVE-2022-27191
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2064702
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-27191
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-27191
• article
  https://groups.google.com/g/golang-announce/c/-cp44ypCT5s/m/wmegxkLiAQAJ
• report
  https://access.redhat.com/security/cve/CVE-2022-41717
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41717
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41717
• article
  https://go.dev/cl/455635
• article
  https://go.dev/cl/455717
• article
  https://go.dev/issue/56350
• article
  https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ
• advisory
  https://pkg.go.dev/vuln/GO-2022-1144
• report
  https://access.redhat.com/security/cve/CVE-2022-41722
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2203008
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41722
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41722
• report
  https://access.redhat.com/security/cve/CVE-2022-41723