Resource exhaustion in Goproxy - CVE-2023-37788

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU81426

Resource exhaustion in Goproxy - CVE-2023-37788

Published: October 3, 2023 / Updated: October 3, 2023


Vulnerability identifier: #VU81426
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-37788
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

Goproxy
Red Hat OpenShift Container Platform
crun-wasm (Red Hat package)
toolbox (Red Hat package)
wasmedge (Red Hat package)
golang-github-prometheus-promu (Red Hat package)
coreos-installer (Red Hat package)
butane (Red Hat package)
containernetworking-plugins (Red Hat package)
runc (Red Hat package)
google-benchmark (Red Hat package)
crun (Red Hat package)
openshift-gitops-kam (Red Hat package)
skopeo (Red Hat package)
spdlog (Red Hat package)
gtest (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
buildah (Red Hat package)
containers-common (Red Hat package)
conmon (Red Hat package)
nmstate (Red Hat package)
haproxy (Red Hat package)
ignition (Red Hat package)
container-selinux (Red Hat package)
kata-containers (Red Hat package)
catch (Red Hat package)
podman (Red Hat package)
openshift-kuryr (Red Hat package)
openshift4-aws-iso (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
rust-afterburn (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
fmt (Red Hat package)
ovn23.09 (Red Hat package)
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenStack
OpenShift Data Foundation (formerly OpenShift Container Storage)
Robotic Process Automation for Cloud Pak

How to mitigate CVE-2023-37788

Install update from vendor's website.

Red Hat OpenShift Container Platform - addressed in versions 4.13.17, 4.14.0, 4.14.34, 4.14.38, 4.15.0, 4.15.13, 4.16.3
crun-wasm (Red Hat package) - addressed in versions 0.0-3.rhaos4.14.el8, 1.8.5-3.rhaos4.14.el9
toolbox (Red Hat package) - update to 0.1.2-1.rhaos4.14.el9
wasmedge (Red Hat package) - update to 0.12.1-2.rhaos4.14.el9
golang-github-prometheus-promu (Red Hat package) - update to 0.15.0-15.1.gitd5383c5.el8
coreos-installer (Red Hat package) - addressed in versions 0.17.0-1.rhaos4.14.el8, 0.17.0-1.rhaos4.14.el9
butane (Red Hat package) - update to 0.19.0-1.1.rhaos4.14.el8
containernetworking-plugins (Red Hat package) - update to 1.0.1-11.1.rhaos4.14.el8
runc (Red Hat package) - addressed in versions 1.1.9-2.1.rhaos4.14.el8, 1.1.9-2.1.rhaos4.14.el9
google-benchmark (Red Hat package) - update to 1.8.2-1.el9
crun (Red Hat package) - addressed in versions 1.9.2-1.rhaos4.14.el8, 1.9.2-1.rhaos4.14.el9
openshift-gitops-kam (Red Hat package) - update to 1.10.0-34.el8
skopeo (Red Hat package) - addressed in versions 1.11.2-10.1.rhaos4.14.el8, 1.11.2-10.1.rhaos4.14.el9
spdlog (Red Hat package) - update to 1.12.0-1.rhaos4.14.el9
gtest (Red Hat package) - update to 1.13.0-1.el9
cri-tools (Red Hat package) - addressed in versions 1.27.0-2.1.el8, 1.27.0-2.1.el9
cri-o (Red Hat package) - addressed in versions 1.27.1-8.1.rhaos4.14.git3fecb83.el8, 1.27.1-8.1.rhaos4.14.git3fecb83.el9
buildah (Red Hat package) - addressed in versions 1.29.1-10.1.rhaos4.14.el8, 1.29.1-10.1.rhaos4.14.el9
containers-common (Red Hat package) - update to 1-51.rhaos4.14.el8
conmon (Red Hat package) - addressed in versions 2.1.7-3.1.rhaos4.14.el8, 2.1.7-3.1.rhaos4.14.el9
nmstate (Red Hat package) - update to 2.2.12-1.rhaos4.14.el8
haproxy (Red Hat package) - update to 2.6.13-1.rhaos4.14.el8
Red Hat Advanced Cluster Management for Kubernetes - update to 2.12.0
ignition (Red Hat package) - update to 2.16.2-1.1.rhaos4.14.el9
container-selinux (Red Hat package) - addressed in versions 2.221.0-1.rhaos4.14.el8, 2.221.0-2.rhaos4.14.el9
kata-containers (Red Hat package) - update to 3.1.3-4.rhaos4.14.el9
catch (Red Hat package) - update to 3.3.2-1.el9
podman (Red Hat package) - addressed in versions 4.4.1-10.1.rhaos4.14.el8, 4.4.1-10.1.rhaos4.14.el9
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.14.0
openshift-kuryr (Red Hat package) - update to 4.14.0-202309272140.p0.g8926a29.assembly.stream.el8
openshift4-aws-iso (Red Hat package) - update to 4.14.0-202309272140.p0.gd2acdd5.assembly.stream.el8
openshift-ansible (Red Hat package) - addressed in versions 4.14.0-202310062327.p0.gf781421.assembly.stream.el8, 4.14.0-202310062327.p0.gf781421.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.14.0-202310191146.p0.g0c63f9d.assembly.stream.el8, 4.14.0-202310191146.p0.g0c63f9d.assembly.stream.el9
openshift (Red Hat package) - addressed in versions 4.14.0-202310210404.p0.gf67aeb3.assembly.stream.el8, 4.14.0-202310210404.p0.gf67aeb3.assembly.stream.el9
rust-afterburn (Red Hat package) - update to 5.4.3-1.rhaos4.14.el9
kernel (Red Hat package) - update to 5.14.0-284.36.1.el9_2
kernel-rt (Red Hat package) - update to 5.14.0-284.36.1.rt14.321.el9_2
fmt (Red Hat package) - update to 9.1.0-1.el9
Red Hat OpenStack - update to 16.2
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.10, 23.0.10
ovn23.09 (Red Hat package) - update to 23.09.0-37.el9fdp

External References

Related Security Bulletins