Red Hat Security Advisory: OpenShift Container Platform 4.14.9 packages and security update

Fixed packages 6

Vulnerabilities 2

• High 7.5
  CVE-2023-47108 Public exploit

  DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

  OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have…

  open-telemetry opentelemetry-go-contrib kubescape k3s Ubuntu Azure Linux Wolfi Go
  Nov 10, 2023
• Medium 6.5
  CVE-2023-6476

  Cri-o: pods are able to break out of resource confinement on cgroupv2

  A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of servi…

  Red Hat Red Hat OpenShift Container Platform 4.14 Red Hat OpenShift Container Platform 4.13 Red Hat OpenShift Container Platform 3.11 Azure Linux Go
  Jan 9, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2251198
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253994
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0207.json
• report
  https://access.redhat.com/security/cve/CVE-2023-6476
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6476
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6476
• report
  https://access.redhat.com/security/cve/CVE-2023-47108
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-47108
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-47108
• article
  https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw