SB2023051915 - Multiple vulnerabilities in OpenShift Container Platform 4.13
Published: May 19, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 secuirty vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2022-41717)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to excessive memory growth when handling HTTP/2 server requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
2) Incorrect authorization (CVE-ID: CVE-2022-2990)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect handling of the supplementary groups in the Buildah container engine. A local user with direct access to the affected container where supplementary groups are used can set access permissions and execute a binary code in that container.3) Protection Mechanism Failure (CVE-ID: CVE-2022-3259)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to missing HTTP Strict Transport Security (HSTS) header. A remote attacker can perform MitM attack.
4) Resource exhaustion (CVE-ID: CVE-2022-41723)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in the HPACK decoder. A remote attacker can send a specially crafted HTTP/2 stream to the application, cause resource exhaustion and perform a denial of service (DoS) attack.
5) Resource management error (CVE-ID: CVE-2022-41724)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources in crypto/tls when handling large TLS handshake records. A remote attacker can send specially crafted data to the application and perform a denial of service (DoS) attack.
The vulnerability affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).
6) Resource exhaustion (CVE-ID: CVE-2022-41725)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper control over internal resources in net/http and mime/multipart. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
7) Input validation error (CVE-ID: CVE-2023-0056)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within the http_wait_for_response() function when handling HTTP/2 requests. A remote attacker can send a specially crafted HTTP request the proxy server and perform a denial of service (DoS) attack.
8) Improper access control (CVE-ID: CVE-2023-0229)
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote user can set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.
9) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2023-0778)
The vulnerability allows a remote attacker to gain compromise the affected system.
The vulnerability exists due to a race condition. A remote attacker can replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.
10) Resource exhaustion (CVE-ID: CVE-2023-25577)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when parsing multipart form data with many fields. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
11) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2023-25725)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP/1 requests. A remote attacker can send a specially crafted HTTP request with empty fields, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
Remediation
Install update from vendor's website.