Red Hat Security Advisory: OpenShift Container Platform 4.14.22 packages and security update

Fixed packages 98

Vulnerabilities 2

• High 7.5
  CVE-2023-45288 Public exploit EPSS 89%

  HTTP/2 CONTINUATION flood in net/http

  An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 4, 2024
• High 7.5
  CVE-2024-1394

  Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

  A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Azure Linux Go
  Mar 21, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262921
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268273
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1897.json
• report
  https://access.redhat.com/security/cve/CVE-2023-45288
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45288
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45288
• article
  https://nowotarski.info/http2-continuation-flood/
• advisory
  https://pkg.go.dev/vuln/GO-2024-2687
• advisory
  https://www.kb.cert.org/vuls/id/421644
• report
  https://access.redhat.com/security/cve/CVE-2024-1394
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1394
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1394
• article
  https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136
• article
  https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6
• article
  https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f
• advisory
  https://pkg.go.dev/vuln/GO-2024-2660
• article
  https://vuln.go.dev/ID/GO-2024-2660.json