Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.5 (collectd-libpod-stats) security update

Fixed packages 1

Vulnerabilities 9

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• Critical 9.8
  CVE-2023-24538 Public exploit

  Backticks not treated as string delimiters in html/template

  Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, th…

  Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.5
  CVE-2023-24534

  Excessive memory allocation in net/http and net/textproto

  HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate…

  Go standard library net/textproto katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.5
  CVE-2023-24536

  Excessive resource consumption in net/http, net/textproto and mime/multipart

  Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consum…

  Go standard library net/textproto mime/multipart katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.5
  CVE-2023-24537

  Infinite loop in parsing in go/scanner

  Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

  Go standard library go/scanner katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.5
  CVE-2023-39325 Public exploit

  HTTP/2 rapid reset can cause excessive work in net/http

  A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 11, 2023
• Unscored —
  CVE-2022-41724

  Panic on large handshake records in crypto/tls

  Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 cli…

  Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 28, 2023
• Unscored —
  CVE-2022-41725

  Excessive resource consumption in mime/multipart

  A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in th…

  Go standard library mime/multipart katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 28, 2023
• Unscored —
  CVE-2023-29409 Public exploit

  Large RSA keys can cause high CPU usage in crypto/tls

  Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA…

  Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 2, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178488
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178492
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184481
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184482
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184483
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184484
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228743
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242803
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2243296
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5964.json
• report
  https://access.redhat.com/security/cve/CVE-2022-41724
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41724
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41724
• article
  https://go.dev/cl/468125
• article
  https://go.dev/issue/58001
• article
  https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
• advisory
  https://pkg.go.dev/vuln/GO-2023-1570
• report
  https://access.redhat.com/security/cve/CVE-2022-41725
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41725
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41725
• article
  https://go.dev/cl/468124
• article
  https://go.dev/issue/58006
• advisory
  https://pkg.go.dev/vuln/GO-2023-1569
• report
  https://access.redhat.com/security/cve/CVE-2023-24534
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24534
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24534
• article
  https://go.dev/issue/58975
• article
  https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8
• report
  https://access.redhat.com/security/cve/CVE-2023-24536
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24536
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24536
• article
  https://go.dev/issue/59153
• report
  https://access.redhat.com/security/cve/CVE-2023-24537
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24537
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24537
• article
  https://github.com/golang/go/issues/59180
• report
  https://access.redhat.com/security/cve/CVE-2023-24538