-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: OpenShift Container Platform 4.13.3 bug fix and security update Advisory ID: RHSA-2023:3540-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2023:3540 Issue date: 2023-06-13 CVE Names: CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-29400 ===================================================================== 1. Summary: Red Hat OpenShift Container Platform release 4.13.3 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenShift Container Platform 4.13 - noarch, x86_64 3. Description: Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge device deployments and is built from the edge capabilities of Red Hat OpenShift. MicroShift is an application that is deployed on top of Red Hat Enterprise Linux devices at the edge, providing an efficient way to operate single-node clusters in these low-resource environments. This advisory contains the RPM packages for Red Hat build of MicroShift 4.13.3. Read the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2023:3537 Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. Security Fix(es): * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) * golang: go/parser: Infinite loop in parsing (CVE-2023-24537) * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538) * golang: html/template: improper sanitization of CSS values (CVE-2023-24539) * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All of the bug fixes may not be documented in this advisory. Read the following release notes documentation for details about these changes: https://access.redhat.com/documentation/en-us/microshift/4.13/html/release_notes/index All Red Hat build of MicroShift 4.13 users are advised to use these updated packages and images when they are available in the RPM repository. 4. Solution: For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters 2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption 2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation 2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing 2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values 2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes 6. JIRA issues fixed (https://issues.redhat.com/): OCPBUGS-13548 - ovnk fails to run on a disconnected MicroShift instance (no default route) OCPBUGS-14276 - MicroShift 4.13 fails to build after including Kubernetes bump to 1.26.5 7. Package List: Red Hat OpenShift Container Platform 4.13: Source: microshift-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9.src.rpm noarch: microshift-release-info-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9.noarch.rpm microshift-selinux-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9.noarch.rpm x86_64: microshift-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9.x86_64.rpm microshift-networking-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2023-24534 https://access.redhat.com/security/cve/CVE-2023-24536 https://access.redhat.com/security/cve/CVE-2023-24537 https://access.redhat.com/security/cve/CVE-2023-24538 https://access.redhat.com/security/cve/CVE-2023-24539 https://access.redhat.com/security/cve/CVE-2023-29400 https://access.redhat.com/security/updates/classification/#moderate 9. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZIlEuNzjgjWX9erEAQhxFg//aR3DmV2HcyS8YJysRbAI7eLmezOWNQkj t6yzwFTxl4mj7rkdobcZiiyei5UNxgm6tTmFmFRusX7GRAFnyvVjjMoWEV27oMJT Z2SYKDB/umH7l5THHJAap7eHZKzSEcVuU2UM1viYIscCq2cCiLH6czWAzi2bGQJx GmOKb1J19rU2rz8tQdKRKITANCLMzgDQ9/AasmytLYIEJ8N38CsZ3yhmGiZvloOZ mDWY9sP35k5G1ts2ivN/Y3YJWfagrF3tZGbSqamx0VEicDdOk88SRlkw9KVdwI+6 Vp5u6z9IBjK+AGIjYtz+weHywYWzZTtt95+xssgrySaJ+F379a4GYh5VJh+tJrJq dm+TD035eAM+98aVCkme07hgtt+5GW3rQoNFwc2J7HgjExApNtLryKmxZEoSJQjX Lt2k9sp+0CMx3r5xAEYFk4T2OIos7GEmXrVRWxjHfQaEZPFHVp490TqXogbEWYPH vYKGgFS6oGXfP6L+AZnvlof+tRq/Nx1JJv9LN95LpzJGK+qOe4aakLCU6RG/J1Ga EAaH21MAhyg5KuPeNk/QpdP5iFCZxHXDvSeHTwt0BEoDDyKU5e+YDmCe+7gSrQhZ Vedymh8kDv65Lu6SoXgcIEtACDeop7LAl314YrosP3TOSNUctWUTwujaqb4WhtwH vf8hK6yf/4I= =2za8 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce