Multiple vulnerabilities in OpenShift Container Platform 4.11

Published: 2023-07-06

Risk	Medium
Patch available	YES
Number of vulnerabilities	7
CVE-ID	CVE-2022-23772 CVE-2022-24675 CVE-2022-28327 CVE-2022-30629 CVE-2022-41717 CVE-2023-3089 CVE-2023-24540
CWE-ID	CWE-400 CWE-120 CWE-190 CWE-330 CWE-770 CWE-326 CWE-94
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #5 is available.
Vulnerable software Subscribe	Red Hat OpenShift Container Platform Client/Desktop applications / Software for system administration skopeo (Red Hat package) Operating systems & Components / Operating system package or component runc (Red Hat package) Operating systems & Components / Operating system package or component podman (Red Hat package) Operating systems & Components / Operating system package or component openshift-kuryr (Red Hat package) Operating systems & Components / Operating system package or component openshift-clients (Red Hat package) Operating systems & Components / Operating system package or component openshift-ansible (Red Hat package) Operating systems & Components / Operating system package or component openshift (Red Hat package) Operating systems & Components / Operating system package or component cri-o (Red Hat package) Operating systems & Components / Operating system package or component containernetworking-plugins (Red Hat package) Operating systems & Components / Operating system package or component conmon (Red Hat package) Operating systems & Components / Operating system package or component buildah (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 7 vulnerabilities.

1) Resource exhaustion

EUVDB-ID: #VU62038

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23772

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the Rat.SetString(0 function in math/big. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.11.0 - 4.11.43

skopeo (Red Hat package): before 1.5.2-4.rhaos4.11.el8

runc (Red Hat package): before 1.1.2-2.rhaos4.11.el8

podman (Red Hat package): before 4.0.2-7.rhaos4.11.el8

openshift-kuryr (Red Hat package): before 4.11.0-202306280915.p0.gc732699.assembly.stream.el8

openshift-clients (Red Hat package): before 4.11.0-202306231116.p0.g2ae2303.assembly.stream.el8

openshift-ansible (Red Hat package): before 4.11.0-202306230041.p0.g0a466d7.assembly.stream.el8

openshift (Red Hat package): before 4.11.0-202306260054.p0.g990d55b.assembly.stream.el8

cri-o (Red Hat package): before 1.24.6-2.rhaos4.11.git4bfe15a.el8

containernetworking-plugins (Red Hat package): before 1.0.1-6.rhaos4.11.el8

conmon (Red Hat package): before 2.1.2-3.rhaos4.11.el8

buildah (Red Hat package): before 1.23.4-3.rhaos4.11.el8

External links

http://access.redhat.com/errata/RHSA-2023:3914

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU64266

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-24675

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the Golang's library encoding/pem. A remote attacker can send to victim a large (more than 5 MB) PEM input to cause a stack overflow in Decode and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.11.0 - 4.11.43

skopeo (Red Hat package): before 1.5.2-4.rhaos4.11.el8

runc (Red Hat package): before 1.1.2-2.rhaos4.11.el8

podman (Red Hat package): before 4.0.2-7.rhaos4.11.el8

openshift-kuryr (Red Hat package): before 4.11.0-202306280915.p0.gc732699.assembly.stream.el8

openshift-clients (Red Hat package): before 4.11.0-202306231116.p0.g2ae2303.assembly.stream.el8

openshift-ansible (Red Hat package): before 4.11.0-202306230041.p0.g0a466d7.assembly.stream.el8

openshift (Red Hat package): before 4.11.0-202306260054.p0.g990d55b.assembly.stream.el8

cri-o (Red Hat package): before 1.24.6-2.rhaos4.11.git4bfe15a.el8

containernetworking-plugins (Red Hat package): before 1.0.1-6.rhaos4.11.el8

conmon (Red Hat package): before 2.1.2-3.rhaos4.11.el8

buildah (Red Hat package): before 1.23.4-3.rhaos4.11.el8

External links

http://access.redhat.com/errata/RHSA-2023:3914

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU64269

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-28327

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to integer overflow in the Golang's library crypto/elliptic. A remote attacker can send a specially crafted scalar input longer than 32 bytes to cause P256().ScalarMult or P256().ScalarBaseMult to panic and perform a denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.11.0 - 4.11.43

skopeo (Red Hat package): before 1.5.2-4.rhaos4.11.el8

runc (Red Hat package): before 1.1.2-2.rhaos4.11.el8

podman (Red Hat package): before 4.0.2-7.rhaos4.11.el8

openshift-kuryr (Red Hat package): before 4.11.0-202306280915.p0.gc732699.assembly.stream.el8

openshift-clients (Red Hat package): before 4.11.0-202306231116.p0.g2ae2303.assembly.stream.el8

openshift-ansible (Red Hat package): before 4.11.0-202306230041.p0.g0a466d7.assembly.stream.el8

openshift (Red Hat package): before 4.11.0-202306260054.p0.g990d55b.assembly.stream.el8

cri-o (Red Hat package): before 1.24.6-2.rhaos4.11.git4bfe15a.el8

containernetworking-plugins (Red Hat package): before 1.0.1-6.rhaos4.11.el8

conmon (Red Hat package): before 2.1.2-3.rhaos4.11.el8

buildah (Red Hat package): before 1.23.4-3.rhaos4.11.el8

External links

http://access.redhat.com/errata/RHSA-2023:3914

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use of insufficiently random values

EUVDB-ID: #VU66122

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30629

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: No

Description

The vulnerability allows a remote attacker gain access to sensitive information.

The vulnerability exists in crypto/tls implementation when generating TLS tickets age. The newSessionTicketMsgTLS13.ageAdd is always set to "0" instead of a random value.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.11.0 - 4.11.43

skopeo (Red Hat package): before 1.5.2-4.rhaos4.11.el8

runc (Red Hat package): before 1.1.2-2.rhaos4.11.el8

podman (Red Hat package): before 4.0.2-7.rhaos4.11.el8

openshift-kuryr (Red Hat package): before 4.11.0-202306280915.p0.gc732699.assembly.stream.el8

openshift-clients (Red Hat package): before 4.11.0-202306231116.p0.g2ae2303.assembly.stream.el8

openshift-ansible (Red Hat package): before 4.11.0-202306230041.p0.g0a466d7.assembly.stream.el8

openshift (Red Hat package): before 4.11.0-202306260054.p0.g990d55b.assembly.stream.el8

cri-o (Red Hat package): before 1.24.6-2.rhaos4.11.git4bfe15a.el8

containernetworking-plugins (Red Hat package): before 1.0.1-6.rhaos4.11.el8

conmon (Red Hat package): before 2.1.2-3.rhaos4.11.el8

buildah (Red Hat package): before 1.23.4-3.rhaos4.11.el8

External links

http://access.redhat.com/errata/RHSA-2023:3914

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Allocation of Resources Without Limits or Throttling

EUVDB-ID: #VU70334

Risk: Medium

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-41717

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to excessive memory growth when handling HTTP/2 server requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.11.0 - 4.11.43

skopeo (Red Hat package): before 1.5.2-4.rhaos4.11.el8

runc (Red Hat package): before 1.1.2-2.rhaos4.11.el8

podman (Red Hat package): before 4.0.2-7.rhaos4.11.el8

openshift-kuryr (Red Hat package): before 4.11.0-202306280915.p0.gc732699.assembly.stream.el8

openshift-clients (Red Hat package): before 4.11.0-202306231116.p0.g2ae2303.assembly.stream.el8

openshift-ansible (Red Hat package): before 4.11.0-202306230041.p0.g0a466d7.assembly.stream.el8

openshift (Red Hat package): before 4.11.0-202306260054.p0.g990d55b.assembly.stream.el8

cri-o (Red Hat package): before 1.24.6-2.rhaos4.11.git4bfe15a.el8

containernetworking-plugins (Red Hat package): before 1.0.1-6.rhaos4.11.el8

conmon (Red Hat package): before 2.1.2-3.rhaos4.11.el8

buildah (Red Hat package): before 1.23.4-3.rhaos4.11.el8

External links

http://access.redhat.com/errata/RHSA-2023:3914

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) Inadequate Encryption Strength

EUVDB-ID: #VU78005

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-3089

CWE-ID: CWE-326 - Inadequate Encryption Strength

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists within the OpenShift container platform configuration with enabled FIPS mode, which resulted in usage of not validated cryptographic modules. A remote attacker can perform various attacks against not validated cryptographic modules and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.11.0 - 4.11.43

skopeo (Red Hat package): before 1.5.2-4.rhaos4.11.el8

runc (Red Hat package): before 1.1.2-2.rhaos4.11.el8

podman (Red Hat package): before 4.0.2-7.rhaos4.11.el8

openshift-kuryr (Red Hat package): before 4.11.0-202306280915.p0.gc732699.assembly.stream.el8

openshift-clients (Red Hat package): before 4.11.0-202306231116.p0.g2ae2303.assembly.stream.el8

openshift-ansible (Red Hat package): before 4.11.0-202306230041.p0.g0a466d7.assembly.stream.el8

openshift (Red Hat package): before 4.11.0-202306260054.p0.g990d55b.assembly.stream.el8

cri-o (Red Hat package): before 1.24.6-2.rhaos4.11.git4bfe15a.el8

containernetworking-plugins (Red Hat package): before 1.0.1-6.rhaos4.11.el8

conmon (Red Hat package): before 2.1.2-3.rhaos4.11.el8

buildah (Red Hat package): before 1.23.4-3.rhaos4.11.el8

External links

http://access.redhat.com/errata/RHSA-2023:3914

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Code Injection

EUVDB-ID: #VU75791

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-24540

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation when processing whitespace characters. A remote attacker can send a specially crafted request and execute arbitrary JavaScript code.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.11.0 - 4.11.43

skopeo (Red Hat package): before 1.5.2-4.rhaos4.11.el8

runc (Red Hat package): before 1.1.2-2.rhaos4.11.el8

podman (Red Hat package): before 4.0.2-7.rhaos4.11.el8

openshift-kuryr (Red Hat package): before 4.11.0-202306280915.p0.gc732699.assembly.stream.el8

openshift-clients (Red Hat package): before 4.11.0-202306231116.p0.g2ae2303.assembly.stream.el8

openshift-ansible (Red Hat package): before 4.11.0-202306230041.p0.g0a466d7.assembly.stream.el8

openshift (Red Hat package): before 4.11.0-202306260054.p0.g990d55b.assembly.stream.el8

cri-o (Red Hat package): before 1.24.6-2.rhaos4.11.git4bfe15a.el8

containernetworking-plugins (Red Hat package): before 1.0.1-6.rhaos4.11.el8

conmon (Red Hat package): before 2.1.2-3.rhaos4.11.el8

buildah (Red Hat package): before 1.23.4-3.rhaos4.11.el8

External links

http://access.redhat.com/errata/RHSA-2023:3914

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.