Red Hat Security Advisory: Red Hat OpenShift Enterprise security update

Fixed packages 20

Vulnerabilities 3

• Critical 9.8
  CVE-2023-24540

  Improper handling of JavaScript whitespace in html/template

  Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized…

  Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Alpine Wolfi Go
  May 11, 2023
• High 7.0
  CVE-2023-3089

  Ocp & fips mode

  A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

  Red Hat Red Hat OpenShift Container Platform 4 Red Hat Advanced Cluster Management for Kubernetes 2 Red Hat OpenShift Virtualization 4
  Jul 5, 2023
• Medium 5.3
  CVE-2022-41717 Public exploit

  Excessive memory growth in net/http and golang.org/x/net/http2

  An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 8, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-001
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161274
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2196027
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2212085
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3910.json
• report
  https://access.redhat.com/security/cve/CVE-2022-41717
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41717
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41717
• article
  https://go.dev/cl/455635
• article
  https://go.dev/cl/455717
• article
  https://go.dev/issue/56350
• article
  https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ
• advisory
  https://pkg.go.dev/vuln/GO-2022-1144
• report
  https://access.redhat.com/security/cve/CVE-2023-3089
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3089
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3089
• report
  https://access.redhat.com/security/cve/CVE-2023-24540
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24540
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24540
• article
  https://go.dev/issue/59721
• article
  https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU