Red Hat Security Advisory: OpenShift Container Platform 4.13.3 packages and security update

Fixed packages 52

Vulnerabilities 5

• Critical 9.8
  CVE-2023-24538 Public exploit

  Backticks not treated as string delimiters in html/template

  Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, th…

  Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.5
  CVE-2023-24534

  Excessive memory allocation in net/http and net/textproto

  HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate…

  Go standard library net/textproto katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.5
  CVE-2023-24536

  Excessive resource consumption in net/http, net/textproto and mime/multipart

  Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consum…

  Go standard library net/textproto mime/multipart katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.5
  CVE-2023-24537

  Infinite loop in parsing in go/scanner

  Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

  Go standard library go/scanner katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.5
  CVE-2023-30861 Public exploit

  Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

  Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` he…

  pallets flask python-flask flask Debian Ubuntu Azure Linux PyPI
  May 2, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2196643
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3536.json
• report
  https://access.redhat.com/security/cve/CVE-2023-24534
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184483
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24534
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24534
• article
  https://go.dev/issue/58975
• article
  https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8
• report
  https://access.redhat.com/security/cve/CVE-2023-24536
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184482
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24536
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24536
• article
  https://go.dev/issue/59153
• report
  https://access.redhat.com/security/cve/CVE-2023-24537
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184484
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24537
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24537
• article
  https://github.com/golang/go/issues/59180
• report
  https://access.redhat.com/security/cve/CVE-2023-24538
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184481
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24538
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24538
• article
  https://github.com/golang/go/issues/59234
• report
  https://access.redhat.com/security/cve/CVE-2023-30861
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-30861
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-30861
• article
  https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b
• article
  https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq