GoogleOSV:SUSE-SU-2024:3344-1Security update for kubernetes1.25
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
98.4%
This update for kubernetes1.25 fixes the following issues:
- CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869)
- CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
- CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)
Bug fixes:
- Update go to version 1.22.5 in build requirements. (bsc#1229858)
References
bugzilla.suse.com/1216109
bugzilla.suse.com/1216123
bugzilla.suse.com/1221400
bugzilla.suse.com/1226136
bugzilla.suse.com/1229858
bugzilla.suse.com/1229867
bugzilla.suse.com/1229869
bugzilla.suse.com/1230323
www.suse.com/security/cve/CVE-2023-39325
www.suse.com/security/cve/CVE-2023-44487
www.suse.com/security/cve/CVE-2023-45288
www.suse.com/security/cve/CVE-2024-24786
www.suse.com/support/update/announcement/2024/suse-su-20243344-1/
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
98.4%