Red Hat OpenShift Container Platform: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 24

• Critical 9.1
  CVE-2019-25210

  An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets …

  k9s cilium-cli Wolfi
  Mar 3, 2024
• High 8.6
  CVE-2024-2398 EPSS 36%

  HTTP/2 push headers memory-leak

  When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the prev…

  curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 27, 2024
• High 8.3
  CVE-2024-3727

  Containers/image: digest type does not guarantee valid type

  A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 9, 2024
• High 7.5
  CVE-2023-45142

  OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

  OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when ma…

  open-telemetry opentelemetry-go-contrib k3s buildkitd Ubuntu Azure Linux Alpine Wolfi Go
  Oct 12, 2023
• High 7.5
  CVE-2023-47108 Public exploit

  DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

  OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have…

  open-telemetry opentelemetry-go-contrib kubescape k3s Ubuntu Azure Linux Wolfi Go
  Nov 10, 2023
• High 7.5
  CVE-2023-52425

  libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in t…

  insighttoolkit4 expat swish-e matanza Debian Ubuntu Azure Linux Alpine
  Feb 4, 2024
• High 7.5
  CVE-2024-1394

  Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

  A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Azure Linux Go
  Mar 21, 2024
• High 7.5
  CVE-2024-22189

  QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

  quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to e…

  quic-go quic-go k3s caddy Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 4, 2024
• High 7.5
  CVE-2024-24784

  Comments in display names are incorrectly handled in net/mail

  The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• High 7.5
  CVE-2024-24786

  Infinite loop in JSON unmarshaling in google.golang.org/protobuf

  The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown opti…

  google.golang.org/protobuf google.golang.org/protobuf/internal/encoding/json google.golang.org/protobuf/encoding/protojson katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• High 7.5
  CVE-2024-28110

  Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

  Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak cre…

  cloudevents sdk-go guac telegraf Azure Linux Wolfi Go
  Mar 6, 2024
• High 7.5
  CVE-2024-28757 Public exploit

  libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created vi…

  insighttoolkit4 expat matanza vtk Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 10, 2024
• High 7.4
  CVE-2024-29180

  webpack-dev-middleware Path Traversal vulnerability

  Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The…

  webpack webpack-dev-middleware katib-suggestion-hyperopt katib-earlystopping Wolfi npm
  Mar 21, 2024
• High 7.0
  CVE-2023-29483

  Potential DoS via the Tudoor mechanism in eventlet and dnspython

  eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does n…

  kubeflow-pipelines-visualization-server dnspython eventlet dnspython Debian Ubuntu Wolfi PyPI
  Apr 11, 2024
• Medium 6.5
  CVE-2023-45290

  Memory exhaustion in multipart form parsing in net/textproto and net/http

  When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

  Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 6.5
  CVE-2024-28849

  Proxy-Authorization header kept across hosts in follow-redirects

  follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authent…

  follow-redirects follow-redirects lerna kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  Mar 14, 2024
• Medium 5.9
  CVE-2023-48795 Public exploit Scanner template EPSS 94%

  Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

  The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

  zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io
  Dec 18, 2023
• Medium 5.9
  CVE-2024-24783

  Verify panics on certificates with an unknown public key algorithm in crypto/x509

  Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyC…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 5.4
  CVE-2024-24785

  Errors returned from JSON marshaling may break template escaping in html/template

  If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

  Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 5.3
  CVE-2024-0874

  Coredns: cd bit response is cached and served later

  A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.

  Red Hat Red Hat OpenShift Container Platform 4.14 Red Hat OpenShift Container Platform 4.16 Red Hat OpenShift Container Platform 4.15 Azure Linux Wolfi Go
  Apr 25, 2024
• Medium 4.9
  CVE-2024-28176

  jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

  jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…

  panva jose sqlpad sqlpad-compat Ubuntu Wolfi npm
  Mar 9, 2024
• Medium 4.3
  CVE-2023-45289

  Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

  When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will fo…

  Go standard library net/http net/http/cookiejar golang Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 4.3
  CVE-2024-28180

  Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

  Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…

  go-jose go-jose zot kubescape Debian Azure Linux Alpine Wolfi Go
  Mar 9, 2024
• Low 2.7
  CVE-2024-3177 Public exploit

  Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin

  A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFr…

  Kubernetes Kubernetes kubeflow-pipelines-apiserver argocd-image-updater Debian Azure Linux Wolfi Go
  Apr 22, 2024

Revision history

1. 2025-08-26 #42

   Neue Updates von openSUSE aufgenommen

2. 2025-06-04 #41

   Neue Updates von SUSE aufgenommen

3. 2025-04-22 #40

   Neue Updates von Red Hat aufgenommen

4. 2025-02-24 #39

   Neue Updates von Red Hat aufgenommen

5. 2024-12-17 #38

   Neue Updates von Red Hat aufgenommen

6. 2024-12-02 #37

   Neue Updates von Red Hat aufgenommen

7. 2024-11-26 #36

   Neue Updates von Red Hat aufgenommen

8. 2024-11-19 #35

   Neue Updates von Red Hat aufgenommen

9. 2024-11-18 #34

   Neue Updates von Red Hat aufgenommen

10. 2024-11-11 #33

    Neue Updates von Red Hat aufgenommen

11. 2024-10-30 #32

    Neue Updates von Red Hat aufgenommen

12. 2024-10-29 #31

    Neue Updates von Red Hat aufgenommen

13. 2024-10-28 #30

    Neue Updates von Red Hat aufgenommen

14. 2024-10-23 #29

    Neue Updates von Red Hat aufgenommen

15. 2024-10-16 #28

    Neue Updates von Red Hat aufgenommen

16. 2024-10-15 #27

    Neue Updates von Red Hat aufgenommen

17. 2024-10-13 #26

    Neue Updates von Red Hat aufgenommen

18. 2024-10-07 #25

    Neue Updates von Red Hat aufgenommen

19. 2024-10-03 #24

    Neue Updates von Red Hat aufgenommen

20. 2024-10-01 #23

    Neue Updates von Red Hat aufgenommen

21. 2024-09-25 #22

    Neue Updates von Red Hat aufgenommen

22. 2024-09-24 #21

    Neue Updates von Red Hat aufgenommen

23. 2024-09-18 #20

    Neue Updates von Red Hat aufgenommen

24. 2024-09-16 #19

    Neue Updates von Red Hat aufgenommen

25. 2024-08-29 #18

    Neue Updates von Red Hat aufgenommen

References

• Red Hat Security Advisory RHSA-2024:0040 vom 2024-06-27
  https://access.redhat.com/errata/RHSA-2024:0040
• Red Hat Security Advisory RHSA-2024:0041 vom 2024-06-27
  https://access.redhat.com/errata/RHSA-2024:0041
• Red Hat Security Advisory RHSA-2024:0043 vom 2024-06-27
  https://access.redhat.com/errata/RHSA-2024:0043
• Red Hat Security Advisory RHSA-2024:0045 vom 2024-06-27
  https://access.redhat.com/errata/RHSA-2024:0045
• Red Hat Security Advisory RHSA-2024:3637 vom 2024-07-01
  https://access.redhat.com/errata/RHSA-2024:3637
• Red Hat Security Advisory RHSA-2024:3617 vom 2024-07-01
  https://access.redhat.com/errata/RHSA-2024:3617
• Red Hat Security Advisory RHSA-2024:1616 vom 2024-07-01
  https://access.redhat.com/errata/RHSA-2024:1616
• Rocky Linux Security Advisory RLSA-2024:3968 vom 2024-07-02
  https://errata.build.resf.org/RLSA-2024:3968
• Red Hat Security Advisory RHSA-2024:4150 vom 2024-07-03
  https://access.redhat.com/errata/RHSA-2024:4150
• Red Hat Security Advisory RHSA-2024:4159 vom 2024-07-03
  https://access.redhat.com/errata/RHSA-2024:4159
• Fedora Security Advisory FEDORA-2024-BD8FE42929 vom 2024-07-06
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-bd8fe42929
• Red Hat Security Advisory RHSA-2024:4591 vom 2024-07-17
  https://access.redhat.com/errata/RHSA-2024:4591
• Red Hat Security Advisory RHSA-2024:4613 vom 2024-07-25
  https://access.redhat.com/errata/RHSA-2024:4613
• Red Hat Security Advisory RHSA-2024:4699 vom 2024-07-25
  https://access.redhat.com/errata/RHSA-2024:4699
• Red Hat Security Advisory RHSA-2024:4850 vom 2024-07-31
  https://access.redhat.com/errata/RHSA-2024:4850
• Red Hat Security Advisory RHSA-2024:4846 vom 2024-07-31
  https://access.redhat.com/errata/RHSA-2024:4846
• Red Hat Security Advisory RHSA-2024:4960 vom 2024-08-07
  https://access.redhat.com/errata/RHSA-2024:4960
• Red Hat Security Advisory RHSA-2024:5094 vom 2024-08-08
  https://access.redhat.com/errata/RHSA-2024:5094
• Red Hat Security Advisory RHSA-2024:5258 vom 2024-08-13
  https://access.redhat.com/errata/RHSA-2024:5258
• Amazon Linux Security Advisory ALASNITRO-ENCLAVES-2024-042 vom 2024-08-13
  https://alas.aws.amazon.com/AL2/ALASNITRO-ENCLAVES-2024-042.html
• Red Hat Security Advisory RHSA-2024:5294 vom 2024-08-14
  https://access.redhat.com/errata/RHSA-2024:5294
• Oracle Linux Security Advisory ELSA-2024-5294 vom 2024-08-14
  https://linux.oracle.com/errata/ELSA-2024-5294.html
• Oracle Linux Security Advisory ELSA-2024-5258 vom 2024-08-14
  https://linux.oracle.com/errata/ELSA-2024-5258.html
• Red Hat Security Advisory RHSA-2024:5200 vom 2024-08-19
  https://access.redhat.com/errata/RHSA-2024:5200
• Red Hat Security Advisory RHSA-2024:5202 vom 2024-08-19
  https://access.redhat.com/errata/RHSA-2024:5202
• Red Hat Security Advisory RHSA-2024:5438 vom 2024-08-21
  https://access.redhat.com/errata/RHSA-2024:5438
• Red Hat Security Advisory RHSA-2024:5951 vom 2024-08-28
  https://access.redhat.com/errata/RHSA-2024:5951
• Red Hat Security Advisory RHSA-2024:6054 vom 2024-08-30
  https://access.redhat.com/errata/RHSA-2024:6054
• Red Hat Security Advisory RHSA-2024:6708 vom 2024-09-16
  https://access.redhat.com/errata/RHSA-2024:6708
• Red Hat Security Advisory RHSA-2024:6755 vom 2024-09-18
  https://access.redhat.com/errata/RHSA-2024:6755
• Red Hat Security Advisory RHSA-2024:6687 vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6687
• Red Hat Security Advisory RHSA-2024:6824 vom 2024-09-24
  https://access.redhat.com/errata/RHSA-2024:6824
• Red Hat Security Advisory RHSA-2024:7164 vom 2024-09-26
  https://access.redhat.com/errata/RHSA-2024:7164
• Red Hat Security Advisory RHSA-2024:7179 vom 2024-10-02
  https://access.redhat.com/errata/RHSA-2024:7179
• Red Hat Security Advisory RHSA-2024:7174 vom 2024-10-02
  https://access.redhat.com/errata/RHSA-2024:7174
• Red Hat Security Advisory RHSA-2024:7179 vom 2024-10-02
  https://access.redhat.com/errata/RHSA-2024:7182
• Red Hat Security Advisory RHSA-2024:3718 vom 2024-10-02
  https://access.redhat.com/errata/RHSA-2024:3718
• Red Hat Security Advisory RHSA-2024:7436 vom 2024-10-02
  https://access.redhat.com/errata/RHSA-2024:7436
• Red Hat Security Advisory RHSA-2024:3717 vom 2024-10-02
  https://access.redhat.com/errata/RHSA-2024:3717
• Red Hat Security Advisory RHSA-2024:7187 vom 2024-10-03
  https://access.redhat.com/errata/RHSA-2024:7187
• Red Hat Security Advisory RHSA-2024:7184 vom 2024-10-03
  https://access.redhat.com/errata/RHSA-2024:7184
• Red Hat Security Advisory RHSA-2024:7323 vom 2024-10-07
  https://access.redhat.com/errata/RHSA-2024:7323
• Red Hat Security Advisory RHSA-2024:8040 vom 2024-10-14
  https://access.redhat.com/errata/RHSA-2024:8040
• Red Hat Security Advisory RHSA-2024:7922 vom 2024-10-16
  https://access.redhat.com/errata/RHSA-2024:7922
• Red Hat Security Advisory RHSA-2024:7939 vom 2024-10-16
  https://access.redhat.com/errata/RHSA-2024:7941
• Red Hat Security Advisory RHSA-2024:8260 vom 2024-10-24
  https://access.redhat.com/errata/RHSA-2024:8260
• Red Hat Security Advisory RHSA-2024:8534 vom 2024-10-28
  https://access.redhat.com/errata/RHSA-2024:8534
• Red Hat Security Advisory RHSA-2024:8434 vom 2024-10-29
  https://access.redhat.com/errata/RHSA-2024:8434
• Red Hat Security Advisory RHSA-2024:8425 vom 2024-10-31
  https://access.redhat.com/errata/RHSA-2024:8425
• Red Hat Security Advisory RHSA-2024:8676 vom 2024-10-30
  https://access.redhat.com/errata/RHSA-2024:8676
• Red Hat Security Advisory RHSA-2024:9181 vom 2024-11-12
  https://access.redhat.com/errata/RHSA-2024:9181
• Red Hat Security Advisory RHSA-2024:9098 vom 2024-11-12
  https://access.redhat.com/errata/RHSA-2024:9098
• Red Hat Security Advisory RHSA-2024:9097 vom 2024-11-12
  https://access.redhat.com/errata/RHSA-2024:9097
• Red Hat Security Advisory RHSA-2024:9102 vom 2024-11-12
  https://access.redhat.com/errata/RHSA-2024:9102
• Red Hat Security Advisory RHSA-2024:9960 vom 2024-11-19
  https://access.redhat.com/errata/RHSA-2024:9960
• Red Hat Security Advisory RHSA-2024:9615 vom 2024-11-20
  https://access.redhat.com/errata/RHSA-2024:9615
• Red Hat Security Advisory RHSA-2024:10147 vom 2024-11-26
  https://access.redhat.com/errata/RHSA-2024:10147
• Red Hat Security Advisory RHSA-2024:8704 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:8704
• Red Hat Security Advisory RHSA-2024:11293 vom 2024-12-17
  https://access.redhat.com/errata/RHSA-2024:11293
• Red Hat Security Advisory RHSA-2024:6122 vom 2025-02-25
  https://access.redhat.com/errata/RHSA-2024:6122
• Red Hat Security Advisory RHSA-2025:4019 vom 2025-04-23
  https://access.redhat.com/errata/RHSA-2025:4019
• SUSE Security Update SUSE-SU-2025:20013-1 vom 2025-06-04
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021364.html
• SUSE Security Update SUSE-SU-2025:20055-1 vom 2025-06-04
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021310.html
• openSUSE Security Update OPENSUSE-SU-2025:0323-1 vom 2025-08-26
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TAOZOXVVSHLUMSNGQ4WCSWQAB5DM7EZH/