Stay Secure with the Latest Linux Advisories

security advisorysecurity updateimportant

Red Hat OpenShift 2.3.6: RHSA-2023-4624-01 Important OAuth2 Exploit

Red Hat OpenShift Service Mesh 2.3.6 Containers Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenShift Service Mesh Containers for 2.3.6 security update Advisory ID: RHSA-2023:4624-01 Product: Red Hat OpenShift Service Mesh Advisory URL: https://access.redhat.com/errata/RHSA-2023:4624 Issue date: 2023-08-11 CVE Names: CVE-2023-2828 CVE-2023-35941 CVE-2023-35942 CVE-2023-35943 CVE-2023-35944 CVE-2023-35945 ===================================================================== 1. Summary: Red Hat OpenShift Service Mesh 2.3.6 Containers Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. Security Fix(es): * envoy: OAuth2 credentials exploit with permanent validity (CVE-2023-35941) * envoy: Incorrect handling of HTTP requests and responses with mixed case schemes (CVE-2023-35944) * envoy: HTTP/2 memory leak in nghttp2 codec (CVE-2023-35945) * envoy: gRPC access log crash caused by the listener draining (CVE-2023-35942) * envoy: CORS filter segfault when origin header is removed (CVE-2023-35943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in theReferences section. 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4. Bugs fixed (https://bugzilla.redhat.com/): 2217977 - CVE-2023-35941 envoy: OAuth2 credentials exploit with permanent validity 2217978 - CVE-2023-35942 envoy: gRPC access log crash caused by the listener draining 2217983 - CVE-2023-35945 envoy: HTTP/2 memory leak in nghttp2 codec 2217985 - CVE-2023-35944 envoy: Incorrect handling of HTTP requests and responses with mixed case schemes 2217987 - CVE-2023-35943 envoy: CORS filter segfault when origin header is removed 5. References: https://access.redhat.com/security/cve/CVE-2023-2828 https://access.redhat.com/security/cve/CVE-2023-35941 https://access.redhat.com/security/cve/CVE-2023-35942 https://access.redhat.com/security/cve/CVE-2023-35943 https://access.redhat.com/security/cve/CVE-2023-35944 https://access.redhat.com/security/cve/CVE-2023-35945 https://access.redhat.com/security/updates/classification/#important 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIcBAEBCAAGBQJk1pfYAAoJENzjgjWX9erE200P/2Y3yaoe64sMk4EThWMQnyDf IeHQt7welubO7E6MbIF+8yclV1ckQUFL5ajX8IWtqrTvvnZjYNXmRxSubbPgrBNa MUQiyLvj6UXIsMqxaJN9n6rtz1ItbiBNK/AH6ITdN4TAHYG+fzTI58PapJ9g8urX 8Pd00dx953Jj2gU5toyw6VTR/fJp3ZCgbQxmI78FSnsN77i2/q6WOkJ0TRLcGe+z GJw62bxyNKGA1I72NoZqyt/SmIqIhfXP+ofaA4kgWP8XI4/pjL2SDvNsVC0wMNZx zQO1cZvYBDo//oZ3NBtR5YpFNZSxpDvv6eiuGOP3LNsTaXot5nAZLSkpzyCFCY9v xccDTjVSYysz/aGqa6vTjCd264P4JVMewI/rfDPfaqV3PcCrtm64YCedNTBEwXMx uMbdbW02xiX9sRa7Ln38FjvDMCfdOAHaoNOmbOnfS4erQuWF9cJxYXMGPBIk+PY4 XtxrOPONWbyFPCTspH2D+ISaibu+rK363ZacEXgZ5JOCo5H38y4BINTUPoC2cxF3 ezwQgKMLPHeCOKBlesQnoPz/EeOL0d3eeNzQvvCAnUk2GCBqazfbxOrjFlqdp9zK ugK8VgJcAFiEDeLrhYpSK88BgScJSE/p5cCKdJy3BSHugnVSRD9iKyccuowC3vcT ZlAhHXpt+D9ytCT8F+R4 =ZtLZ -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Red Hat OpenShift Service Mesh security patch fixes several vulnerabilities to protect installations for clients.. Red Hat, OpenShift, Security Update, OAuth2 Exploit, Service Mesh. . Severity: Important. LinuxSecurity.com Team

Aug 11, 2023 •Important Red Hat