Skip to content
OpenAdvisories
Critical RHSA-2023:3545 2 CVEs

Red Hat Security Advisory: OpenShift Container Platform 4.12.21 packages and security update

Published Sep 30, 2024 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 16

ReleasePackageFixed in
Red Hat · Openshift Ironic 4 openshift_ironic:4.12::el9 python-flask 1:2.0.1-3.el9
Red Hat · Openshift Ironic 4 openshift_ironic:4.12::el9 python-flask-doc 1:2.0.1-3.el9
Red Hat · Openshift Ironic 4 openshift_ironic:4.12::el9 python3-flask 1:2.0.1-3.el9
Red Hat · OpenShift 4 openshift:4.12::el8 podman 3:4.2.0-4.1.rhaos4.12.el8
Red Hat · OpenShift 4 openshift:4.12::el8 podman-catatonit 3:4.2.0-4.1.rhaos4.12.el8
Red Hat · OpenShift 4 openshift:4.12::el8 podman-catatonit-debuginfo 3:4.2.0-4.1.rhaos4.12.el8
Red Hat · OpenShift 4 openshift:4.12::el8 podman-debuginfo 3:4.2.0-4.1.rhaos4.12.el8
Red Hat · OpenShift 4 openshift:4.12::el8 podman-debugsource 3:4.2.0-4.1.rhaos4.12.el8
Red Hat · OpenShift 4 openshift:4.12::el8 podman-docker 3:4.2.0-4.1.rhaos4.12.el8
Red Hat · OpenShift 4 openshift:4.12::el8 podman-gvproxy 3:4.2.0-4.1.rhaos4.12.el8
Red Hat · OpenShift 4 openshift:4.12::el8 podman-gvproxy-debuginfo 3:4.2.0-4.1.rhaos4.12.el8
Red Hat · OpenShift 4 openshift:4.12::el8 podman-plugins 3:4.2.0-4.1.rhaos4.12.el8
Red Hat · OpenShift 4 openshift:4.12::el8 podman-plugins-debuginfo 3:4.2.0-4.1.rhaos4.12.el8
Red Hat · OpenShift 4 openshift:4.12::el8 podman-remote 3:4.2.0-4.1.rhaos4.12.el8
Red Hat · OpenShift 4 openshift:4.12::el8 podman-remote-debuginfo 3:4.2.0-4.1.rhaos4.12.el8
Red Hat · OpenShift 4 openshift:4.12::el8 podman-tests 3:4.2.0-4.1.rhaos4.12.el8

Vulnerabilities 2

  • Critical 9.8
    CVE-2023-24540

    Improper handling of JavaScript whitespace in html/template

    Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized…

    Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2023-30861 Public exploit

    Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

    Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` he…

    pallets flask python-flask flask Debian Ubuntu Azure Linux PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2196027
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2196643
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3545.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-24540
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-24540
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-24540
  • article
    https://go.dev/issue/59721
  • article
    https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
  • report
    https://access.redhat.com/security/cve/CVE-2023-30861
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-30861
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-30861
  • article
    https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b
  • article
    https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq