Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (collectd-sensubility) security update

Fixed packages 2

Vulnerabilities 3

• High 7.5
  CVE-2024-1394

  Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

  A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Azure Linux Go
  Mar 21, 2024
• Unscored —
  CVE-2023-39326

  Denial of service via chunk extensions in net/http

  A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…

  Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 6, 2023
• Unscored —
  CVE-2023-45287

  Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

  Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of…

  Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi Go
  Dec 5, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253193
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262921
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2767.json
• report
  https://access.redhat.com/security/cve/CVE-2023-39326
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39326
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39326
• advisory
  https://pkg.go.dev/vuln/GO-2023-2382
• report
  https://access.redhat.com/security/cve/CVE-2023-45287
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45287
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45287
• advisory
  https://pkg.go.dev/vuln/GO-2023-2375
• report
  https://access.redhat.com/security/cve/CVE-2024-1394
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1394
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1394
• article
  https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136
• article
  https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6
• article
  https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f
• advisory
  https://pkg.go.dev/vuln/GO-2024-2660
• article
  https://vuln.go.dev/ID/GO-2024-2660.json