Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

Red Hat OpenStack 16.2 RHSA-2023:3445-01 Important Etcd Security Fix

red hat
Calendar Grey June 6, 2023
Dist Redhat Esm H88
The latest version 16.2 of Red Hat OpenStack Platform introduces essential security patches for etcd, tackling several significant vulnerabilities.
An update for etcd is now available for Red Hat OpenStack Platform 16.2 (Train)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

A highly-available key value store for shared configuration
Security Fix(es):
* Information discosure via debug function (CVE-2021-28235)
* html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
* golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
* crypto/tls: large handshake records may cause panics (CVE-2022-41724)
* net/http mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
* net/http net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
* net/http net/textproto mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
* go/parser: Infinite loop in parsing (CVE-2023-24537)
* html/template: backticks not treated as string delimiters(CVE-2023-24538)
* html/template: improper sanitization of CSS values (CVE-2023-24539)
* html/template: improper handling of empty HTML attributes (CVE-2023-29400)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.

Topics%20covered

Topics Covered

security advisory important security impact Red Hat OpenStack etcd update

References

https://access.redhat.com/security/cve/CVE-2021-28235 https://access.redhat.com/security/cve/CVE-2022-41723 https://access.redhat.com/security/cve/CVE-2022-41724 https://access.redhat.com/security/cve/CVE-2022-41725 https://access.redhat.com/security/cve/CVE-2023-24534 https://access.redhat.com/security/cve/CVE-2023-24536 https://access.redhat.com/security/cve/CVE-2023-24537 https://access.redhat.com/security/cve/CVE-2023-24538 https://access.redhat.com/security/cve/CVE-2023-24539 https://access.redhat.com/security/cve/CVE-2023-24540 https://access.redhat.com/security/cve/CVE-2023-29400 https://access.redhat.com/security/updates/classification#important

Package List

Red Hat OpenStack Platform 16.2:
Source: etcd-3.3.23-14.el8ost.src.rpm
ppc64le: etcd-3.3.23-14.el8ost.ppc64le.rpm etcd-debuginfo-3.3.23-14.el8ost.ppc64le.rpm etcd-debugsource-3.3.23-14.el8ost.ppc64le.rpm
x86_64: etcd-3.3.23-14.el8ost.x86_64.rpm etcd-debuginfo-3.3.23-14.el8ost.x86_64.rpm etcd-debugsource-3.3.23-14.el8ost.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2023:3445-01
Product: Red Hat OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2023:3445
Issue date: 2023-06-05

Topic

An update for etcd is now available for Red Hat OpenStack Platform 16.2(Train).Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory important security impact Red Hat OpenStack etcd update

Relevant Releases Architectures

Red Hat OpenStack Platform 16.2 - ppc64le, x86_64

Bugs Fixed

2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding

2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption

2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics

2184441 - CVE-2021-28235 etcd: Information discosure via debug function

2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption

2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation

2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing

2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values

2196027 - CVE-2023-24540 golang: html/template: improper handling of JavaScript whitespace

2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.