Red Hat Security Advisory: OpenShift Container Platform 4.12.64 security update

Fixed packages 8

Vulnerabilities 3

• High 7.5
  CVE-2024-34069 Public exploit

  Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

  Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a…

  pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Wolfi PyPI
  May 6, 2024
• Medium 6.5
  CVE-2023-45290

  Memory exhaustion in multipart form parsing in net/textproto and net/http

  When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

  Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 5.4
  CVE-2024-34064 Public exploit

  Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

  Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…

  pallets jinja nodejs kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  May 6, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268017
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2279451
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5810.json
• report
  https://access.redhat.com/security/cve/CVE-2023-45290
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45290
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45290
• article
  http://www.openwall.com/lists/oss-security/2024/03/08/4
• article
  https://go.dev/cl/569341
• article
  https://go.dev/issue/65383
• article
  https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• advisory
  https://pkg.go.dev/vuln/GO-2024-2599
• article
  https://security.netapp.com/advisory/ntap-20240329-0004
• report
  https://access.redhat.com/security/cve/CVE-2024-34064
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2279476
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34064
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34064
• article
  https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj
• report
  https://access.redhat.com/security/cve/CVE-2024-34069
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34069
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34069
• article
  https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692
• article
  https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985