(RHSA-2024:0766) Critical: OpenShift Container Platform 4.15.0 security update

2024-02-2808:08:17

access.redhat.com

openshift container platform

critical

security update

dos vulnerability

cve-2023-45142

cve-2023-47108

cve-2023-48795

cve-2023-39325

cve-2023-44487

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

Low

0.963 High

EPSS

Percentile

99.5%

JSON

Red Hat OpenShift Container Platform is Red Hat’s cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

opentelemetry: DoS vulnerability in otelhttp (CVE-2023-45142)
opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound
cardinality metrics (CVE-2023-47108)
ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
(CVE-2023-48795)
*golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-39325) (CVE-2023-44487)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.