RedHat: RHSA-2023-4470:01 Important: Red Hat Ansible Automation Platform
Summary
Red Hat Ansible Automation Platform provides an enterprise framework for
building, deploying and managing IT automation at scale. IT Managers can
provide top-down guidelines on how automation is applied to individual
teams, while automation developers retain the freedom to write tasks that
leverage existing knowledge without the overhead. Ansible Automation
Platform makes it possible for users across an organization to share, vet,
and manage automation content by means of a simple, powerful, and agentless
language.
Security Fix(es) for openshift-clients:
* golang: net/http: excessive memory growth in a Go server accepting HTTP/2
requests (CVE-2022-41717)
* golang: crypto/tls: large handshake records may cause panics
(CVE-2022-41724)
* golang: net/http, mime/multipart: denial of service from excessive
resource consumption (CVE-2022-41725)
* golang: net/http, net/textproto: denial of service from excessive memory
allocation (CVE-2023-24534)
* golang: net/http, net/textproto, mime/multipart: denial of service from
excessive resource consumption (CVE-2023-24536)
* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
* golang: html/template: backticks not treated as string delimiters
(CVE-2023-24538)
* golang: html/template: improper sanitization of CSS values
(CVE-2023-24539)
* golang: html/template: improper handling of JavaScript whitespace
(CVE-2023-24540)
* golang: html/template: improper handling of empty HTML attributes
(CVE-2023-29400)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Summary
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
References
https://access.redhat.com/security/cve/CVE-2022-41717 https://access.redhat.com/security/cve/CVE-2022-41724 https://access.redhat.com/security/cve/CVE-2022-41725 https://access.redhat.com/security/cve/CVE-2023-24534 https://access.redhat.com/security/cve/CVE-2023-24536 https://access.redhat.com/security/cve/CVE-2023-24537 https://access.redhat.com/security/cve/CVE-2023-24538 https://access.redhat.com/security/cve/CVE-2023-24539 https://access.redhat.com/security/cve/CVE-2023-24540 https://access.redhat.com/security/cve/CVE-2023-29400 https://access.redhat.com/security/updates/classification/#important
Package List
Red Hat Ansible Automation Platform 2.3 for RHEL 8:
Source:
openshift-clients-4.12.0-202307200611.p0.g49844f7.assembly.stream.el8.src.rpm
x86_64:
openshift-clients-4.12.0-202307200611.p0.g49844f7.assembly.stream.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
An update is now available for Red Hat Ansible Automation Platform 2.3Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Red Hat Ansible Automation Platform 2.3 for RHEL 8 - x86_64
Bugs Fixed
2161274 - CVE-2022-41717 golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests
2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption
2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics
2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters
2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation
2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing
2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values
2196027 - CVE-2023-24540 golang: html/template: improper handling of JavaScript whitespace
2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes
