DeutschShown in its original language — a full translation is planned for a future version.
Red Hat OpenShift Container Platform: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen
view advisory published 2023-06-06
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in der Red Hat OpenShift Container Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-29400US | high7.3 | — | ||
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normaliz… | ||||
| CVE-2023-24540US | critical9.8 | — | ||
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029"… | ||||
| CVE-2023-24539US | high7.3 | — | ||
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpe… | ||||
| CVE-2023-24538US | critical9.8 | Exploit | ||
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a… | ||||
| CVE-2023-24537US | high7.5 | — | ||
Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow. | ||||
| CVE-2023-24536US | high7.5 | — | ||
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multi… | ||||
| CVE-2023-24534US | high7.5 | — | ||
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input dat… | ||||
| CVE-2022-41724US | high7.5 | — | ||
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when a… | ||||
| CVE-2022-41723US | high7.5OT elevated | — | ||
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. | ||||
| CVE-2022-41722US | high7.5 | — | ||
A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path… | ||||
| CVE-2022-27191US | high7.5OT elevated | — | ||
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey. | ||||
02
references
External citations — patches, advisories, analysis.
- RedHat Security Advisory vom 2023-06-06external
- RedHat Security Advisory vom 2023-06-06external
- Red Hat Security Advisory RHSA-2023:3409 vom 2023-06-08external
- Red Hat Security Advisory RHSA-2023:3410 vom 2023-06-08external
- Red Hat Security Advisory RHSA-2023:3495 vom 2023-06-13external
- Red Hat Security Advisory RHSA-2023:3537 vom 2023-06-14external
- Red Hat Security Advisory RHSA-2023:3540 vom 2023-06-14external
- Red Hat Security Advisory RHSA-2023:3545 vom 2023-06-14external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan