Red Hat Security Advisory: OpenShift Container Platform 4.16.0 security update

Fixed packages 77

Vulnerabilities 9

• High 8.3
  CVE-2024-3727

  Containers/image: digest type does not guarantee valid type

  A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 9, 2024
• High 7.5
  CVE-2024-24784

  Comments in display names are incorrectly handled in net/mail

  The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• High 7.5
  CVE-2024-24786

  Infinite loop in JSON unmarshaling in google.golang.org/protobuf

  The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown opti…

  google.golang.org/protobuf google.golang.org/protobuf/internal/encoding/json google.golang.org/protobuf/encoding/protojson katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• High 7.0
  CVE-2023-29483

  Potential DoS via the Tudoor mechanism in eventlet and dnspython

  eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does n…

  kubeflow-pipelines-visualization-server dnspython eventlet dnspython Debian Ubuntu Wolfi PyPI
  Apr 11, 2024
• Medium 6.5
  CVE-2023-45290

  Memory exhaustion in multipart form parsing in net/textproto and net/http

  When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

  Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 5.9
  CVE-2024-24783

  Verify panics on certificates with an unknown public key algorithm in crypto/x509

  Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyC…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 5.4
  CVE-2024-24785

  Errors returned from JSON marshaling may break template escaping in html/template

  If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

  Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 4.9
  CVE-2024-28176

  jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

  jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…

  panva jose sqlpad sqlpad-compat Ubuntu Wolfi npm
  Mar 9, 2024
• Medium 4.3
  CVE-2023-45289

  Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

  When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will fo…

  Go standard library net/http net/http/cookiejar golang Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262921
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268017
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268018
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268021
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268022
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268046
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2274520
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2274767
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0045.json
• report
  https://access.redhat.com/security/cve/CVE-2023-29483
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-29483
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-29483
• article
  https://www.dnspython.org/news/2.6.0rc1/
• report
  https://access.redhat.com/security/cve/CVE-2023-45289
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45289
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45289
• report
  https://access.redhat.com/security/cve/CVE-2023-45290
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45290
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45290
• article
  http://www.openwall.com/lists/oss-security/2024/03/08/4
• article
  https://go.dev/cl/569341
• article
  https://go.dev/issue/65383
• article
  https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• advisory
  https://pkg.go.dev/vuln/GO-2024-2599
• article
  https://security.netapp.com/advisory/ntap-20240329-0004
• report
  https://access.redhat.com/security/cve/CVE-2024-3727
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3727
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3727
• report
  https://access.redhat.com/security/cve/CVE-2024-24783
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24783
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24783
• advisory
  https://github.com/advisories/GHSA-3q2c-pvp5-3cqp
• article
  https://go.dev/cl/569339
• article
  https://go.dev/issue/65390
• advisory
  https://pkg.go.dev/vuln/GO-2024-2598