Skip to content
OpenAdvisories
Critical RHSA-2024:0880 4 CVEs

Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.31.1 security update

Published Oct 1, 2024 · Updated Oct 18, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Serverless 1 serverless:1.0::el8 openshift-serverless-clients 0:1.10.0-6.el8

Vulnerabilities 4

  • Critical 9.8
    CVE-2023-49569

    Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

    A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only …

    go-git go-git scorecard nuclei Debian Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2023-49568

    Maliciously crafted Git server replies can cause DoS on go-git clients

    A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion …

    go-git go-git zot kots Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.9
    CVE-2023-48795 Public exploit Scanner template EPSS 94%

    Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

    zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io
  • Unscored —
    CVE-2023-39326

    Denial of service via chunk extensions in net/http

    A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…

    Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • article
    https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1.31
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2253330
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2254210
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2258143
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2258165
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0880.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-39326
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-39326
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-39326
  • advisory
    https://pkg.go.dev/vuln/GO-2023-2382
  • report
    https://access.redhat.com/security/cve/CVE-2023-48795
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-48795
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-48795
  • article
    https://access.redhat.com/solutions/7071748
  • article
    https://terrapin-attack.com/
  • report
    https://access.redhat.com/security/cve/CVE-2023-49568
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-49568
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-49568
  • article
    https://github.com/go-git/go-git/security/advisories/GHSA-mw99-9chc-xw7r
  • report
    https://access.redhat.com/security/cve/CVE-2023-49569
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-49569
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-49569
  • article
    https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88