Red Hat OpenStack Platform : Mehrere Schwachstellen

Summary

Product

Vulnerabilities 5

• Critical 9.8
  CVE-2021-28235 Public exploit

  Etcd-io Improper Authentication vulnerability

  Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

  etcd etcd etcd go.etcd.io/etcd/v3 Debian Ubuntu Azure Linux Go
  Apr 4, 2023
• High 7.5
  CVE-2023-24534

  Excessive memory allocation in net/http and net/textproto

  HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate…

  Go standard library net/textproto katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.5
  CVE-2023-24536

  Excessive resource consumption in net/http, net/textproto and mime/multipart

  Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consum…

  Go standard library net/textproto mime/multipart katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.5
  CVE-2023-30861 Public exploit

  Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

  Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` he…

  pallets flask python-flask flask Debian Ubuntu Azure Linux PyPI
  May 2, 2023
• Low 3.1
  CVE-2023-32082

  etcd key name can be accessed via LeaseTimeToLive API

  etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read p…

  etcd-io etcd etcd etcd Debian Ubuntu Azure Linux Go
  May 11, 2023

Revision history

1. 2023-11-30 #6

   Neue Updates von Red Hat aufgenommen

2. 2023-08-06 #5

   Neue Updates von Oracle Linux aufgenommen

3. 2023-07-20 #4

   Neue Updates von SUSE aufgenommen

4. 2023-06-13 #3

   Neue Updates von Red Hat aufgenommen

5. 2023-06-08 #2

   Neue Updates von Red Hat aufgenommen

6. 2023-06-05 #1

   Initiale Fassung

References

• Red Hat Security Advisory RHSA-2023:7341 vom 2023-11-30
  https://access.redhat.com/errata/RHSA-2023:7341
• Oracle Linux Security Advisory ELSA-2023-12710 vom 2023-08-06
  https://linux.oracle.com/errata/ELSA-2023-12710.html
• SUSE Security Update SUSE-SU-2023:2263-2 vom 2023-07-20
  https://lists.suse.com/pipermail/sle-security-updates/2023-July/015545.html
• Red Hat Security Advisory RHSA-2023:3536 vom 2023-06-14
  https://access.redhat.com/errata/RHSA-2023:3536
• Red Hat Security Advisory RHSA-2023:3545 vom 2023-06-14
  https://access.redhat.com/errata/RHSA-2023:3545
• Red Hat Security Advisory RHSA-2023:3525 vom 2023-06-07
  https://access.redhat.com/errata/RHSA-2023:3525
• RedHat Security Advisory vom 2023-06-05
  https://access.redhat.com/errata/RHSA-2023:3446
• RedHat Security Advisory vom 2023-06-05
  https://access.redhat.com/errata/RHSA-2023:3445
• RedHat Security Advisory vom 2023-06-05
  https://access.redhat.com/errata/RHSA-2023:3444
• RedHat Security Advisory vom 2023-06-05
  https://access.redhat.com/errata/RHSA-2023:3441
• RedHat Security Advisory vom 2023-06-05
  https://access.redhat.com/errata/RHSA-2023:3440