Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · OpenStack 16 openstack:16.2::el8 | etcd | 0:3.3.23-16.el8ost |
| Red Hat · OpenStack 16 openstack:16.2::el8 | etcd-debuginfo | 0:3.3.23-16.el8ost |
| Red Hat · OpenStack 16 openstack:16.2::el8 | etcd-debugsource | 0:3.3.23-16.el8ost |
Vulnerabilities 10
-
High 7.5
HTTP/2 CONTINUATION flood in net/http
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…
-
High 7.5
Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects…
-
High 7.5
Etcd: incomplete fix for cve-2022-41723 in openstack platform
The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2022-41723. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red H…
-
High 7.5
Etcd: incomplete fix for cve-2021-44716 in openstack platform
The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red H…
-
High 7.5
Etcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platform
The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2…
-
Unscored —
Improper handling of HTML-like comments in script contexts in html/template
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be imprope…
-
Unscored —
Improper handling of special tags within script contexts in html/template
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, …
-
Unscored —
Panic when processing post-handshake message on QUIC connections in crypto/tls
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
-
Unscored —
Memory exhaustion in QUIC connection handling in crypto/tls
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in …
-
Unscored —
Denial of service via chunk extensions in net/http
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237773
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237776
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237777
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237778
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2253330
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2268273
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2279357
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2279361
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2279365
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3352.json
-
report
https://access.redhat.com/security/cve/CVE-2023-39318
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-39318
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-39318
-
article
https://go.dev/cl/526156
-
article
https://go.dev/issue/62196
-
article
https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
-
article
https://vuln.go.dev/ID/GO-2023-2041.json
-
report
https://access.redhat.com/security/cve/CVE-2023-39319
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-39319
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-39319
-
article
https://go.dev/cl/526157
-
article
https://go.dev/issue/62197
-
article
https://vuln.go.dev/ID/GO-2023-2043.json
-
report
https://access.redhat.com/security/cve/CVE-2023-39321
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-39321
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-39321
-
article
https://go.dev/cl/523039
-
article
https://go.dev/issue/62266
-
article
https://vuln.go.dev/ID/GO-2023-2044.json
-
report
https://access.redhat.com/security/cve/CVE-2023-39322
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-39322
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-39322
-
article
https://vuln.go.dev/ID/GO-2023-2045.json
-
report
https://access.redhat.com/security/cve/CVE-2023-39326
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-39326
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-39326
-
advisory
https://pkg.go.dev/vuln/GO-2023-2382
-
report
https://access.redhat.com/security/cve/CVE-2023-45288