Red Hat Security Advisory: OpenShift Container Platform 4.15.0 packages and security update

Fixed packages 80

Vulnerabilities 4

• High 7.5
  CVE-2023-39325 Public exploit

  HTTP/2 rapid reset can cause excessive work in net/http

  A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 11, 2023
• Medium 5.9
  CVE-2023-48795 Public exploit Scanner template EPSS 94%

  Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

  The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

  zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io
  Dec 18, 2023
• Unscored —
  CVE-2023-39326

  Denial of service via chunk extensions in net/http

  A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…

  Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 6, 2023
• Unscored —
  CVE-2023-45287

  Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

  Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of…

  Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi Go
  Dec 5, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231370
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242803
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2243296
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2251198
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253193
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253994
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254210
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2258725
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2023_7201.json
• report
  https://access.redhat.com/security/cve/CVE-2023-39325
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39325
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39325
• article
  https://access.redhat.com/security/cve/CVE-2023-44487
• article
  https://go.dev/issue/63417
• advisory
  https://pkg.go.dev/vuln/GO-2023-2102
• article
  https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
• report
  https://access.redhat.com/security/cve/CVE-2023-39326
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39326
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39326
• advisory
  https://pkg.go.dev/vuln/GO-2023-2382
• report
  https://access.redhat.com/security/cve/CVE-2023-45287
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45287
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45287
• advisory
  https://pkg.go.dev/vuln/GO-2023-2375
• report
  https://access.redhat.com/security/cve/CVE-2023-48795
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-48795
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-48795
• article
  https://access.redhat.com/solutions/7071748
• article
  https://terrapin-attack.com/