Red Hat Security Advisory: Red Hat OpenShift Enterprise security update

Fixed packages 28

Vulnerabilities 7

• Critical 9.8
  CVE-2023-24540

  Improper handling of JavaScript whitespace in html/template

  Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized…

  Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Alpine Wolfi Go
  May 11, 2023
• High 7.0
  CVE-2023-3089

  Ocp & fips mode

  A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

  Red Hat Red Hat OpenShift Container Platform 4 Red Hat Advanced Cluster Management for Kubernetes 2 Red Hat OpenShift Virtualization 4
  Jul 5, 2023
• Medium 5.3
  CVE-2022-41717 Public exploit

  Excessive memory growth in net/http and golang.org/x/net/http2

  An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 8, 2022
• Low 3.1
  CVE-2022-30629

  Session tickets lack random ticket_age_add in crypto/tls

  Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

  Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Unscored —
  CVE-2022-23772

  Uncontrolled memory consumption in math/big

  Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Feb 11, 2022
• Unscored —
  CVE-2022-24675 Public exploit

  Stack overflow from a large amount of PEM data in encoding/pem

  encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

  golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go
  Apr 20, 2022
• Unscored —
  CVE-2022-28327

  Panic due to large inputs affecting P-256 curves in crypto/elliptic

  The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

  golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go
  Apr 20, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-001
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053532
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2077688
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2077689
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092793
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161274
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2196027
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2212085
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3914.json
• report
  https://access.redhat.com/security/cve/CVE-2022-23772
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-23772
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-23772
• article
  https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
• report
  https://access.redhat.com/security/cve/CVE-2022-24675
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-24675
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-24675
• article
  https://groups.google.com/g/golang-announce/c/oecdBNLOml8
• report
  https://access.redhat.com/security/cve/CVE-2022-28327
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-28327
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-28327
• report
  https://access.redhat.com/security/cve/CVE-2022-30629
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-30629
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-30629
• article
  https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg
• report
  https://access.redhat.com/security/cve/CVE-2022-41717
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41717
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41717
• article
  https://go.dev/cl/455635
• article
  https://go.dev/cl/455717
• article
  https://go.dev/issue/56350
• article
  https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ
• advisory
  https://pkg.go.dev/vuln/GO-2022-1144
• report
  https://access.redhat.com/security/cve/CVE-2023-3089
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3089
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3089
• report
  https://access.redhat.com/security/cve/CVE-2023-24540
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24540
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24540