Red Hat Security Advisory: OpenShift Container Platform 4.13.8 packages and security update

Fixed packages 3

Vulnerabilities 3

• High 7.5
  CVE-2023-24534

  Excessive memory allocation in net/http and net/textproto

  HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate…

  Go standard library net/textproto katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.3
  CVE-2023-24539

  Improper sanitization of CSS values in html/template

  Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, i…

  Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Alpine Wolfi Go
  May 11, 2023
• High 7.3
  CVE-2023-29400

  Improper handling of empty HTML attributes in html/template

  Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

  Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Alpine Wolfi Go
  May 11, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2196026
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2196029
• article
  https://issues.redhat.com/browse/OCPBUGS-17339
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4459.json
• report
  https://access.redhat.com/security/cve/CVE-2023-24534
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184483
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24534
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24534
• article
  https://go.dev/issue/58975
• article
  https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8
• report
  https://access.redhat.com/security/cve/CVE-2023-24539
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24539
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24539
• article
  https://github.com/golang/go/issues/59720
• article
  https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
• report
  https://access.redhat.com/security/cve/CVE-2023-29400
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-29400
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-29400
• article
  https://go.dev/issue/59722