Skip to content
OpenAdvisories
High RHSA-2023:3541 2 CVEs

Red Hat Security Advisory: OpenShift Container Platform 4.11.43 packages and security update

Published Sep 16, 2024 · Updated Jul 3, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · Openshift Ironic 4 openshift_ironic:4.11::el8 python-flask 1:1.1.2-6.el8
Red Hat · Openshift Ironic 4 openshift_ironic:4.11::el8 python-flask-doc 1:1.1.2-6.el8
Red Hat · Openshift Ironic 4 openshift_ironic:4.11::el8 python3-flask 1:1.1.2-6.el8
Red Hat · OpenShift 4 openshift:4.11::el8 cri-o 0:1.24.5-5.rhaos4.11.git8bf967b.el8
Red Hat · OpenShift 4 openshift:4.11::el8 cri-o-debuginfo 0:1.24.5-5.rhaos4.11.git8bf967b.el8
Red Hat · OpenShift 4 openshift:4.11::el8 cri-o-debugsource 0:1.24.5-5.rhaos4.11.git8bf967b.el8

Vulnerabilities 2

  • High 7.5
    CVE-2023-30861 Public exploit

    Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

    Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` he…

    pallets flask python-flask flask Debian Ubuntu Azure Linux PyPI
  • High 7.1
    CVE-2022-2995

    CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure

    Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set acc…

    cri-o github.com/cri-o/cri-o Azure Linux Go

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • article
    https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2121632
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3541.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-2995
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-2995
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-2995
  • article
    https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
  • report
    https://access.redhat.com/security/cve/CVE-2023-30861
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2196643
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-30861
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-30861
  • article
    https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b
  • article
    https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq