Red Hat Security Advisory: OpenShift Container Platform 4.15.z security update

Fixed packages 6

Vulnerabilities 3

• High 7.5
  CVE-2023-39325 Public exploit

  HTTP/2 rapid reset can cause excessive work in net/http

  A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 11, 2023
• Unscored —
  CVE-2023-39326

  Denial of service via chunk extensions in net/http

  A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…

  Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 6, 2023
• Unscored —
  CVE-2023-45287

  Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

  Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of…

  Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi Go
  Dec 5, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2243296
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253193
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253330
• article
  https://issues.redhat.com/browse/OCPBUGS-18548
• article
  https://issues.redhat.com/browse/OCPBUGS-19288
• article
  https://issues.redhat.com/browse/OCPBUGS-19363
• article
  https://issues.redhat.com/browse/OCPBUGS-19384
• article
  https://issues.redhat.com/browse/OCPBUGS-19422
• article
  https://issues.redhat.com/browse/OCPBUGS-19433
• article
  https://issues.redhat.com/browse/OCPBUGS-19457
• article
  https://issues.redhat.com/browse/OCPBUGS-19488
• article
  https://issues.redhat.com/browse/OCPBUGS-19540
• article
  https://issues.redhat.com/browse/OCPBUGS-19567
• article
  https://issues.redhat.com/browse/OCPBUGS-19632
• article
  https://issues.redhat.com/browse/OCPBUGS-19719
• article
  https://issues.redhat.com/browse/OCPBUGS-20037
• article
  https://issues.redhat.com/browse/OCPBUGS-22322
• article
  https://issues.redhat.com/browse/OCPBUGS-22338
• article
  https://issues.redhat.com/browse/OCPBUGS-22685
• article
  https://issues.redhat.com/browse/OCPBUGS-22809
• article
  https://issues.redhat.com/browse/OCPBUGS-22854
• article
  https://issues.redhat.com/browse/OCPBUGS-22858
• article
  https://issues.redhat.com/browse/OCPBUGS-22936
• article
  https://issues.redhat.com/browse/OCPBUGS-25689
• article
  https://issues.redhat.com/browse/OCPBUGS-25851
• article
  https://issues.redhat.com/browse/OCPBUGS-25904
• article
  https://issues.redhat.com/browse/OCPBUGS-27398
• article
  https://issues.redhat.com/browse/OCPBUGS-27855
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2023_7200.json
• report
  https://access.redhat.com/security/cve/CVE-2023-39325
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39325
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39325
• article
  https://access.redhat.com/security/cve/CVE-2023-44487
• article
  https://go.dev/issue/63417
• advisory
  https://pkg.go.dev/vuln/GO-2023-2102
• article
  https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
• report
  https://access.redhat.com/security/cve/CVE-2023-39326