Red Hat OpenShift Container Platform: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Summary

Product

Vulnerabilities 11

• Critical 9.8
  CVE-2023-24538 Public exploit

  Backticks not treated as string delimiters in html/template

  Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, th…

  Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• Critical 9.8
  CVE-2023-24540

  Improper handling of JavaScript whitespace in html/template

  Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized…

  Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Alpine Wolfi Go
  May 11, 2023
• High 7.5
  CVE-2022-27191

  golang.org/x/crypto/ssh Denial of service via crafted Signer

  The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

  go k3d k3d-proxy k3d-tools Debian Ubuntu Alpine Wolfi Go
  Mar 18, 2022
• High 7.5
  CVE-2022-41723

  Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

  A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 28, 2023
• High 7.5
  CVE-2023-24534

  Excessive memory allocation in net/http and net/textproto

  HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate…

  Go standard library net/textproto katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.5
  CVE-2023-24536

  Excessive resource consumption in net/http, net/textproto and mime/multipart

  Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consum…

  Go standard library net/textproto mime/multipart katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.5
  CVE-2023-24537

  Infinite loop in parsing in go/scanner

  Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

  Go standard library go/scanner katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 6, 2023
• High 7.3
  CVE-2023-24539

  Improper sanitization of CSS values in html/template

  Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, i…

  Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Alpine Wolfi Go
  May 11, 2023
• High 7.3
  CVE-2023-29400

  Improper handling of empty HTML attributes in html/template

  Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

  Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Alpine Wolfi Go
  May 11, 2023
• Unscored —
  CVE-2022-41722

  Path traversal on Windows in path/filepath

  A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute pa…

  Go standard library path/filepath katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Wolfi Go
  Feb 28, 2023
• Unscored —
  CVE-2022-41724

  Panic on large handshake records in crypto/tls

  Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 cli…

  Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 28, 2023

Revision history

1. 2025-11-27 #35

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

2. 2024-05-21 #34

   Neue Updates von Red Hat aufgenommen

3. 2024-02-08 #33

   Neue Updates von Red Hat aufgenommen

4. 2024-01-31 #32

   Neue Updates von Red Hat aufgenommen

5. 2024-01-01 #31

   Neue Updates von Red Hat aufgenommen

6. 2023-11-21 #30

   Neue Updates von Oracle Linux aufgenommen

7. 2023-11-14 #29

   Neue Updates von Red Hat aufgenommen

8. 2023-11-07 #28

   Neue Updates von Red Hat aufgenommen

9. 2023-11-01 #27

   Neue Updates von Amazon aufgenommen

10. 2023-10-19 #26

    Neue Updates von Amazon aufgenommen

11. 2023-10-04 #25

    Neue Updates von Red Hat aufgenommen

12. 2023-09-27 #24

    Neue Updates von Red Hat aufgenommen

13. 2023-09-06 #23

    Neue Updates von Red Hat aufgenommen

14. 2023-08-22 #22

    Neue Updates von Red Hat aufgenommen

15. 2023-08-16 #21

    Neue Updates von Red Hat aufgenommen

16. 2023-08-09 #20

    Neue Updates von Amazon aufgenommen

17. 2023-08-08 #19

    Neue Updates von Red Hat aufgenommen

18. 2023-08-07 #18

    Neue Updates von Red Hat aufgenommen

19. 2023-08-06 #17

    Neue Updates von Red Hat aufgenommen

20. 2023-08-03 #16

    Neue Updates von Red Hat aufgenommen

21. 2023-08-02 #15

    Neue Updates von IBM aufgenommen

22. 2023-08-01 #14

    Neue Updates von Red Hat aufgenommen

23. 2023-07-26 #13

    Neue Updates von Red Hat aufgenommen

24. 2023-07-20 #12

    Neue Updates von Red Hat aufgenommen

25. 2023-07-17 #11

    Neue Updates von Red Hat aufgenommen

References

• RedHat Security Advisory vom 2023-06-06
  https://access.redhat.com/errata/RHSA-2023:3367
• RedHat Security Advisory vom 2023-06-06
  https://access.redhat.com/errata/RHSA-2023:3366
• Red Hat Security Advisory RHSA-2023:3410 vom 2023-06-08
  https://access.redhat.com/errata/RHSA-2023:3410
• Red Hat Security Advisory RHSA-2023:3409 vom 2023-06-08
  https://access.redhat.com/errata/RHSA-2023:3409
• Red Hat Security Advisory RHSA-2023:3495 vom 2023-06-13
  https://access.redhat.com/errata/RHSA-2023:3495
• Red Hat Security Advisory RHSA-2023:3540 vom 2023-06-14
  https://access.redhat.com/errata/RHSA-2023:3540
• Red Hat Security Advisory RHSA-2023:3545 vom 2023-06-14
  https://access.redhat.com/errata/RHSA-2023:3545
• Red Hat Security Advisory RHSA-2023:3537 vom 2023-06-14
  https://access.redhat.com/errata/RHSA-2023:3537
• Red Hat Security Advisory RHSA-2023:3624 vom 2023-06-15
  https://access.redhat.com/errata/RHSA-2023:3624
• Red Hat Security Advisory vom 2023-06-29
  https://access.redhat.com/errata/RHSA-2023:3918
• Red Hat Security Advisory RHSA-2023:3943 vom 2023-06-29
  https://access.redhat.com/errata/RHSA-2023:3943
• Red Hat Security Advisory RHSA-2023:3914 vom 2023-07-06
  https://access.redhat.com/errata/RHSA-2023:3914
• Red Hat Security Advisory RHSA-2023:3910 vom 2023-07-06
  https://access.redhat.com/errata/RHSA-2023:3910
• Red Hat Security Advisory RHSA-2023:3915 vom 2023-07-06
  https://access.redhat.com/errata/RHSA-2023:3915
• Red Hat Security Advisory RHSA-2023:3911 vom 2023-07-06
  https://access.redhat.com/errata/RHSA-2023:3911
• Red Hat Security Advisory RHSA-2023:3925 vom 2023-07-06
  https://access.redhat.com/errata/RHSA-2023:3925
• Red Hat Security Advisory RHSA-2023:4003 vom 2023-07-10
  https://access.redhat.com/errata/RHSA-2023:4003
• Red Hat Security Advisory RHSA-2023:4113 vom 2023-07-18
  https://access.redhat.com/errata/RHSA-2023:4113
• Red Hat Security Advisory RHSA-2023:4112 vom 2023-07-18
  https://access.redhat.com/errata/RHSA-2023:4112
• Red Hat Security Advisory RHSA-2023:4093 vom 2023-07-20
  https://access.redhat.com/errata/RHSA-2023:4093
• Red Hat Security Advisory RHSA-2023:4090 vom 2023-07-21
  https://access.redhat.com/errata/RHSA-2023:4090
• Red Hat Security Advisory RHSA-2023:4091 vom 2023-07-20
  https://access.redhat.com/errata/RHSA-2023:4091
• Red Hat Security Advisory RHSA-2023:4293 vom 2023-07-27
  https://access.redhat.com/errata/RHSA-2023:4293
• Red Hat Security Advisory RHSA-2023:4225 vom 2023-07-27
  https://access.redhat.com/errata/RHSA-2023:4225
• Red Hat Security Advisory RHSA-2023:4289 vom 2023-07-27
  https://access.redhat.com/errata/RHSA-2023:4289
• Red Hat Security Advisory RHSA-2023:4421 vom 2023-08-01
  https://access.redhat.com/errata/RHSA-2023:4421
• Red Hat Security Advisory RHSA-2023:4420 vom 2023-08-01
  https://access.redhat.com/errata/RHSA-2023:4420
• IBM Security Bulletin 7011697 vom 2023-08-03
  https://www.cybersecurity-help.cz/vdb/SB2023080304
• Red Hat Security Advisory RHSA-2023:4470 vom 2023-08-03
  https://access.redhat.com/errata/RHSA-2023:4470
• Red Hat Security Advisory RHSA-2023:4472 vom 2023-08-03
  https://access.redhat.com/errata/RHSA-2023:4472
• Red Hat Security Advisory RHSA-2023:4488 vom 2023-08-07
  https://access.redhat.com/errata/RHSA-2023:4488
• Red Hat Security Advisory RHSA-2023:4335 vom 2023-08-08
  https://access.redhat.com/errata/RHSA-2023:4335
• Red Hat Security Advisory RHSA-2023:4459 vom 2023-08-08
  https://access.redhat.com/errata/RHSA-2023:4459
• Red Hat Security Advisory RHSA-2023:4456 vom 2023-08-08
  https://access.redhat.com/errata/RHSA-2023:4456
• Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2023-026 vom 2023-08-10
  https://alas.aws.amazon.com/AL2/ALASNITRO-ENCLAVES-2023-026.html
• Red Hat Security Advisory RHSA-2023:4664 vom 2023-08-16
  https://access.redhat.com/errata/RHSA-2023:4664
• Red Hat Security Advisory RHSA-2023:4657 vom 2023-08-23
  https://access.redhat.com/errata/RHSA-2023:4657
• Red Hat Security Advisory RHSA-2023:4986 vom 2023-09-06
  https://access.redhat.com/errata/RHSA-2023:4986
• Red Hat Security Advisory RHSA-2023:5376 vom 2023-09-27
  https://access.redhat.com/errata/RHSA-2023:5376
• Red Hat Security Advisory RHSA-2023:5442 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5442
• Amazon Linux Security Advisory ALAS2-2023-2303 vom 2023-10-20
  https://alas.aws.amazon.com/AL2/ALAS-2023-2303.html
• Amazon Linux Security Advisory ALASECS-2023-019 vom 2023-11-01
  https://alas.aws.amazon.com/AL2/ALASECS-2023-019.html
• Red Hat Security Advisory RHSA-2023:6473 vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6473
• Red Hat Security Advisory RHSA-2023:6420 vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6420
• Red Hat Security Advisory RHSA-2023:6402 vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6402
• Red Hat Security Advisory RHSA-2023:6474 vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6474
• Red Hat Security Advisory RHSA-2023:6939 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:6939
• Oracle Linux Security Advisory ELSA-2023-6939 vom 2023-11-21
  https://linux.oracle.com/errata/ELSA-2023-6939.html
• Oracle Linux Security Advisory ELSA-2023-6938 vom 2023-11-21
  https://linux.oracle.com/errata/ELSA-2023-6938.html
• Red Hat Security Advisory RHSA-2023:5006 vom 2023-12-30
  https://access.redhat.com/errata/RHSA-2023:5006
• Red Hat Security Advisory RHSA-2024:0485 vom 2024-01-31
  https://access.redhat.com/errata/RHSA-2024:0485
• Red Hat Security Advisory RHSA-2024:0746 vom 2024-02-08
  https://access.redhat.com/errata/RHSA-2024:0746
• Red Hat Security Advisory RHSA-2024:2944 vom 2024-05-21
  https://access.redhat.com/errata/RHSA-2024:2944
• Rocky Linux Security Advisory RLSA-2023:6938 vom 2025-11-28
  https://errata.build.resf.org/RLSA-2023:6938