Resource exhaustion in Go programming language - CVE-2023-45290

Vulnerability identifier: #VU87197

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-45290

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in net/http due to application does not properly control consumption of internal resources when parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile). A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Go programming language
Gentoo Linux
Amazon Linux AMI
Oracle Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Development Tools Module
openSUSE Leap
Ubuntu
openEuler
AdGuard Home
IBM Concert Software
IBM Process Mining
Consul
Consul Enterprise
Cryostat
Red Hat OpenShift Builds
Run Once Duration Override Operator for Red Hat OpenShift
Ansible Automation Platform
Custom Metrics Autoscaler Operator for Red Hat OpenShift
Red Hat OpenShift distributed tracing (RHOSDT)
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Discovery for IBM Cloud Pak for Data
Kube Descheduler Operator for Red Hat OpenShift
App Connect Enterprise Certified Container
Red Hat Migration Toolkit for Applications
IBM Cloud Pak for Business Automation
IBM Automation Decision Services
IBM Observability with Instana
Operations Dashboard
Nomad
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
go
Storage Ceph
IBM Business Automation Manager Open Editions
Watson CP4D Data Stores
Storage Protect Server
Storage Protect Plus Container Agent
Storage Protect Plus Server
Business Automation Insights
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
golang-1.18-src (Ubuntu package)
golang-1.18 (Ubuntu package)
golang-1.18-go (Ubuntu package)
toolbox
toolbox-tests
toolbox (Red Hat package)
udica
python3x-sqlparse (Red Hat package)
python-sqlparse (Red Hat package)
conmon-rs (Red Hat package)
gvisor-tap-vsock (Red Hat package)
rhc-worker-script (Red Hat package)
python3-podman
podman-docker
podman-help
podman-debugsource
python3-pypodman
podman
podman-debuginfo
golang-github-prometheus-promu (Red Hat package)
butane (Red Hat package)
python3x-pulp-ansible (Red Hat package)
python-pulp-ansible (Red Hat package)
ansible-rulebook (Red Hat package)
automation-eda-controller (Red Hat package)
runc (Red Hat package)
slirp4netns (Red Hat package)
runc
slirp4netns
oci-seccomp-bpf-hook
containernetworking-plugins (Red Hat package)
containernetworking-plugins
receptor (Red Hat package)
skopeo (Red Hat package)
aardvark-dns
fuse-overlayfs (Red Hat package)
netavark
python3x-pydantic (Red Hat package)
python-pydantic (Red Hat package)
openshift-serverless-clients (Red Hat package)
fuse-overlayfs
crun (Red Hat package)
crun
skopeo
skopeo-tests
golang
golang-devel
golang-help
golang-1.17-go (Ubuntu package)
golang-1.17 (Ubuntu package)
golang-1.17-src (Ubuntu package)
golang (Red Hat package)
golang-1.21-src (Ubuntu package)
golang-1.21 (Ubuntu package)
golang-1.21-go (Ubuntu package)
delve
go1.21-doc
go1.21
go1.21-race
go-toolset
golang-src
golang-tests
golang-misc
golang-docs
golang-bin
golang-shared
go1.21-openssl-race
go1.21-openssl-doc
go1.21-openssl
go1.22
go1.22-race
go1.22-doc
golang-1.22-go (Ubuntu package)
golang-1.22 (Ubuntu package)
golang-1.22-src (Ubuntu package)
dev-lang/go
go1.22-openssl-debuginfo
go1.22-openssl-race
go1.22-openssl-doc
go1.22-openssl
buildah (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
buildah-tests
buildah
NetworkManager (Red Hat package)
containers-common (Red Hat package)
containers-common
python-werkzeug (Red Hat package)
conmon (Red Hat package)
conmon
ansible-automation-platform-installer (Red Hat package)
oath-toolkit (Red Hat package)
haproxy (Red Hat package)
ignition (Red Hat package)
ansible-core (Red Hat package)
python3x-requests (Red Hat package)
python-requests (Red Hat package)
container-selinux
container-selinux (Red Hat package)
python3x-jinja2 (Red Hat package)
python-jinja2 (Red Hat package)
git-lfs
git-lfs-doc
git-lfs (Red Hat package)
etcd
python3x-idna (Red Hat package)
python-idna (Red Hat package)
python3x-aiohttp (Red Hat package)
python-aiohttp (Red Hat package)
crit
criu-libs
criu
criu-devel
python3-criu
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
cephadm-ansible (Red Hat package)
podman (Red Hat package)
libslirp
libslirp-devel
libslirp (Red Hat package)
automation-controller (Red Hat package)
automation-hub (Red Hat package)
python3x-galaxy-ng (Red Hat package)
python-galaxy-ng (Red Hat package)
podman-tests
podman-remote
podman-plugins
podman-gvproxy
podman-catatonit
openshift (Red Hat package)
openshift-clients (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
ose-gcp-gcr-image-credential-provider (Red Hat package)
openshift-ansible (Red Hat package)
openshift4-aws-iso (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
python3x-social-auth-app-django (Red Hat package)
python-social-auth-app-django (Red Hat package)
python3x-pillow (Red Hat package)
python-pillow (Red Hat package)
ceph (Red Hat package)
python3x-gunicorn (Red Hat package)
python-gunicorn (Red Hat package)
python3x-black (Red Hat package)
python-black (Red Hat package)
python3x-pyOpenSSL (Red Hat package)
python-pyOpenSSL (Red Hat package)
ovn24.03 (Red Hat package)
python3x-cryptography (Red Hat package)
python-cryptography (Red Hat package)
cockpit-podman
ostree (Red Hat package)
Secondary Scheduler Operator for Red Hat OpenShift (OSSO)
OpenShift API for Data Protection (OADP)
Network Observability plugin for the Openshift Console
Migration Toolkit for Containers
OpenShift Serverless Client
Red Hat OpenShift Container Platform
Red Hat OpenShift GitOps
IBM Cloud Pak System
Red Hat Ceph Storage
IBM Security Verify Access

Install updates from vendor's website.

Go programming language - addressed in versions 1.21.8, 1.22.1
AdGuard Home - update to 0.107.45
IBM Concert Software - update to 2.0.0
Nomad - addressed in versions 1.5.16, 1.6.9, 1.7.6
IBM Process Mining - update to 1.15.0 IF002
Consul - addressed in versions 1.16.7, 1.17.4
Consul Enterprise - update to 1.18.1
go - update to 1.19.13-6
Storage Ceph - update to 8.1
IBM Business Automation Manager Open Editions - update to 8.0.8
golang-1.18-src (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
golang-1.18 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
golang-1.18-go (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
toolbox - update to 0.0.99.5-2.0.1
toolbox-tests - update to 0.0.99.5-2.0.1
toolbox (Red Hat package) - addressed in versions 0.0.99.5-5.el9, 0.1.0-2.rhaos4.16.el8, 0.1.2-1.rhaos4.16.el9
udica - update to 0.2.6-21
python3x-sqlparse (Red Hat package) - update to 0.5.0-1.el8ap
python-sqlparse (Red Hat package) - update to 0.5.0-1.el9ap
conmon-rs (Red Hat package) - addressed in versions 0.6.3-1.rhaos4.16.el8, 0.6.3-1.rhaos4.16.el9
gvisor-tap-vsock (Red Hat package) - update to 0.7.3-3.el9_4
rhc-worker-script (Red Hat package) - update to 0.9-5.el7_9
python3-podman - update to 0.10.1-10
podman-docker - update to 0.10.1-10
podman-help - update to 0.10.1-10
podman-debugsource - update to 0.10.1-10
python3-pypodman - update to 0.10.1-10
podman - update to 0.10.1-10
podman-debuginfo - update to 0.10.1-10
golang-github-prometheus-promu (Red Hat package) - addressed in versions 0.15.0-15.2.gitd5383c5.el9, 0.15.0-17.gitd5383c5.el8
butane (Red Hat package) - addressed in versions 0.16.0-4.rhaos4.12.el8, 0.19.0-3.rhaos4.14.el8, 0.21.0-1.rhaos4.16.el8
python3x-pulp-ansible (Red Hat package) - update to 0.20.7-1.el8ap
python-pulp-ansible (Red Hat package) - update to 0.20.7-1.el9ap
ansible-rulebook (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
automation-eda-controller (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
Red Hat OpenShift Builds - update to 1.1.0
Run Once Duration Override Operator for Red Hat OpenShift - addressed in versions 1.1.1, 1.2.0
runc (Red Hat package) - addressed in versions 1.1.6-8.rhaos4.12.el8, 1.1.12-3.1.rhaos4.16.el8, 1.1.12-3.1.rhaos4.16.el9, 1.1.13-3.rhaos4.13.el8, 1.1.13-3.rhaos4.13.el9, 1.1.13-3.rhaos4.14.el8, 1.1.13-3.rhaos4.14.el9, 1.1.13-4.rhaos4.15.el8, 1.1.13-4.rhaos4.15.el9
slirp4netns (Red Hat package) - update to 1.1.8-2.rhaos4.16.el8
runc - addressed in versions 1.1.12-4.0.1, 1.1.12-5.0.1
slirp4netns - update to 1.2.3-1
oci-seccomp-bpf-hook - update to 1.2.10-1
Secondary Scheduler Operator for Red Hat OpenShift (OSSO) - update to 1.3.0
OpenShift API for Data Protection (OADP) - update to 1.3.2
containernetworking-plugins (Red Hat package) - addressed in versions 1.4.0-2.1.rhaos4.16.el8, 1.4.0-3.rhaos4.12.el8, 1.4.0-3.rhaos4.13.el8, 1.4.0-3.rhaos4.14.el8
containernetworking-plugins - update to 1.4.0-5.0.1
receptor (Red Hat package) - addressed in versions 1.4.8-1.el8ap, 1.4.8-1.el9ap
Network Observability plugin for the Openshift Console - update to 1.6.0
Migration Toolkit for Containers - update to 1.8.4
skopeo (Red Hat package) - addressed in versions 1.9.4-6.rhaos4.12.el8, 1.9.4-6.rhaos4.12.el9, 1.11.3-2.rhaos4.13.el8, 1.11.3-2.rhaos4.13.el9, 1.11.3-2.rhaos4.14.el8, 1.11.3-2.rhaos4.14.el9, 1.11.3-3.rhaos4.15.el8, 1.11.3-3.rhaos4.15.el9, 1.14.4-1.rhaos4.16.el8, 1.14.4-1.rhaos4.16.el9
aardvark-dns - addressed in versions 1.10.0-2.0.1, 1.10.1-2.0.1
fuse-overlayfs (Red Hat package) - update to 1.10-2.rhaos4.16.el8
netavark - update to 1.10.3-1.0.1
python3x-pydantic (Red Hat package) - update to 1.10.15-1.el8ap
python-pydantic (Red Hat package) - update to 1.10.15-1.el9ap
Red Hat OpenShift GitOps - addressed in versions 1.11.6, 1.12.4
openshift-serverless-clients (Red Hat package) - update to 1.12.0-7.el8
fuse-overlayfs - update to 1.13-1.0.1
crun (Red Hat package) - addressed in versions 1.14.3-1.rhaos4.16.el8, 1.14.3-1.rhaos4.16.el9
crun - update to 1.14.3-2
skopeo - update to 1.14.5-3.0.1
skopeo-tests - update to 1.14.5-3.0.1
golang - update to 1.15.7-39
golang-devel - update to 1.15.7-39
golang-help - update to 1.15.7-39
golang-1.17-go (Ubuntu package) - update to 1.17.13-3ubuntu1.3
golang-1.17 (Ubuntu package) - update to 1.17.13-3ubuntu1.3
golang-1.17-src (Ubuntu package) - update to 1.17.13-3ubuntu1.3
golang (Red Hat package) - addressed in versions 1.19.13-9.el9_2, 1.21.9-2.el9_4
golang-1.21-src (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
golang-1.21 (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
golang-1.21-go (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
delve - update to 1.21.2-3
go1.21-doc - addressed in versions 1.21.8-1.27.1, 1.21.8-150000.1.27.1
go1.21 - addressed in versions 1.21.8-1.27.1, 1.21.8-150000.1.27.1
go1.21-race - update to 1.21.8-150000.1.27.1
go-toolset - update to 1.21.9-1
golang-src - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-tests - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-misc - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-docs - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-bin - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-shared - update to 1.21.10-2
go1.21-openssl-race - update to 1.21.13.1-150600.16.3.1
go1.21-openssl-doc - update to 1.21.13.1-150600.16.3.1
go1.21-openssl - update to 1.21.13.1-150600.16.3.1
go1.22 - update to 1.22.1-150000.1.9.1
go1.22-race - update to 1.22.1-150000.1.9.1
go1.22-doc - update to 1.22.1-150000.1.9.1
golang-1.22-go (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
golang-1.22 (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
golang-1.22-src (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
dev-lang/go - update to 1.22.3
golang - update to 1.22.3-1
go1.22-openssl-debuginfo - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl-race - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl-doc - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
buildah (Red Hat package) - addressed in versions 1.23.4-7.rhaos4.12.el8, 1.23.4-7.rhaos4.12.el9, 1.29.1-4.rhaos4.13.el8, 1.29.1-4.rhaos4.13.el9, 1.29.1-12.rhaos4.14.el8, 1.29.1-12.rhaos4.14.el9, 1.29.1-23.rhaos4.15.el8, 1.29.1-23.rhaos4.15.el9, 1.33.7-1.1.rhaos4.16.el8, 1.33.7-1.1.rhaos4.16.el9, 1.33.7-2.el9_4
cri-tools (Red Hat package) - addressed in versions 1.25.0-4.el8, 1.25.0-4.el9, 1.26.0-6.el8, 1.26.0-6.el9, 1.27.0-5.el8, 1.27.0-5.el9, 1.28.0-6.el8, 1.28.0-6.el9, 1.29.0-3.1.el8, 1.29.0-3.1.el9
cri-o (Red Hat package) - addressed in versions 1.25.3-7.rhaos4.12.git44a2cb2.el9, 1.25.5-25.rhaos4.12.git6556f50.el8, 1.25.5-26.rhaos4.12.git635413a.el8, 1.26.5-20.rhaos4.13.git2e90133.el8, 1.26.5-20.rhaos4.13.git2e90133.el9, 1.27.8-5.rhaos4.14.git107168f.el8, 1.27.8-5.rhaos4.14.git107168f.el9, 1.28.9-5.rhaos4.15.git674ed4c.el8, 1.28.9-5.rhaos4.15.git674ed4c.el9, 1.29.5-5.rhaos4.16.git7032128.el8, 1.29.5-5.rhaos4.16.git7032128.el9
OpenShift Serverless Client - update to 1.33.0
buildah-tests - addressed in versions 1.33.8-4, 1.34.0-1
buildah - addressed in versions 1.33.8-4, 1.34.0-1
NetworkManager (Red Hat package) - update to 1.42.2-24.el9_2
containers-common (Red Hat package) - addressed in versions 1-77.rhaos4.16.el8, 1-77.rhaos4.16.el9
containers-common - update to 1-82.0.1
python-werkzeug (Red Hat package) - update to 2.0.3-6.el9
conmon (Red Hat package) - addressed in versions 2.1.2-7.rhaos4.12.el8, 2.1.2-8.rhaos4.12.el9, 2.1.7-4.rhaos4.13.el8, 2.1.7-4.rhaos4.13.el9, 2.1.7-5.rhaos4.14.el8, 2.1.7-5.rhaos4.14.el9, 2.1.7-9.rhaos4.15.el8, 2.1.7-14.rhaos4.15.el9, 2.1.10-2.1.rhaos4.16.el8, 2.1.10-2.1.rhaos4.16.el9
conmon - update to 2.1.10-1
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
Ansible Automation Platform - update to 2.4
Multicluster Engine for Kubernetes - update to 2.4.6
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.4-7.1.el8ap, 2.4-7.1.el9ap
oath-toolkit (Red Hat package) - update to 2.6.12-1.el9cp
haproxy (Red Hat package) - addressed in versions 2.6.13-3.rhaos4.16.el8, 2.8.5-2.rhaos4.16.el9
Custom Metrics Autoscaler Operator for Red Hat OpenShift - update to 2.12.1-394
ignition (Red Hat package) - addressed in versions 2.14.0-7.rhaos4.12.el9, 2.14.0-9.rhaos4.12.el8, 2.15.0-9.rhaos4.13.el9, 2.16.2-4.rhaos4.14.el9, 2.16.2-5.rhaos4.15.el9, 2.18.0-2.1.rhaos4.16.el9
ansible-core (Red Hat package) - addressed in versions 2.15.11-1.el8ap, 2.15.11-1.el9ap
python3x-requests (Red Hat package) - update to 2.32.2-1.el8ap
python-requests (Red Hat package) - update to 2.32.2-1.el9ap
container-selinux - update to 2.229.0-2
container-selinux (Red Hat package) - addressed in versions 2.231.0-1.rhaos4.16.el8, 2.231.0-1.rhaos4.16.el9
python3x-jinja2 (Red Hat package) - update to 3.1.4-1.el8ap
python-jinja2 (Red Hat package) - update to 3.1.4-1.el9ap
Red Hat OpenShift distributed tracing (RHOSDT) - update to 3.2.0
git-lfs - addressed in versions 3.4.1-1.0.1, 3.4.1-2.0.1
git-lfs-doc - addressed in versions 3.4.1-1.0.1, 3.4.1-2.0.1
git-lfs (Red Hat package) - addressed in versions 3.4.1-2.el8_10, 3.4.1-2.el9_4
etcd - addressed in versions 3.4.14-11, 3.4.14-16
python3x-idna (Red Hat package) - update to 3.7-1.el8ap
python-idna (Red Hat package) - update to 3.7-1.el9ap
python3x-aiohttp (Red Hat package) - update to 3.9.5-1.el8ap
python-aiohttp (Red Hat package) - update to 3.9.5-1.el9ap
crit - update to 3.18-5.0.1
criu-libs - update to 3.18-5.0.1
criu - update to 3.18-5.0.1
criu-devel - update to 3.18-5.0.1
python3-criu - update to 3.18-5.0.1
python3x-pulpcore (Red Hat package) - update to 3.28.27-1.el8ap
python-pulpcore (Red Hat package) - update to 3.28.27-1.el9ap
cephadm-ansible (Red Hat package) - update to 4.1.4-1.el9cp
podman (Red Hat package) - addressed in versions 4.2.0-11.rhaos4.12.el9, 4.4.1-7.rhaos4.12.el8, 4.4.1-12.rhaos4.13.el8, 4.4.1-13.rhaos4.13.el9, 4.4.1-18.rhaos4.14.el8, 4.4.1-18.rhaos4.14.el9, 4.4.1-29.rhaos4.15.el8, 4.4.1-29.rhaos4.15.el9, 4.9.4-4.el9_4, 4.9.4-5.1.rhaos4.16.el8, 4.9.4-5.1.rhaos4.16.el9
libslirp - update to 4.4.0-2
libslirp-devel - update to 4.4.0-2
libslirp (Red Hat package) - update to 4.4.0-4.rhaos4.16.el8
Red Hat Advanced Cluster Security for Kubernetes - update to 4.4.2
automation-controller (Red Hat package) - addressed in versions 4.5.7-1.el8ap, 4.5.7-1.el9ap
python3-podman - update to 4.9.0-2
automation-hub (Red Hat package) - addressed in versions 4.9.2-1.el8ap, 4.9.2-1.el9ap
python3x-galaxy-ng (Red Hat package) - update to 4.9.2-1.el8ap
python-galaxy-ng (Red Hat package) - update to 4.9.2-1.el9ap
podman-docker - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
podman-tests - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
podman-remote - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
podman-plugins - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
podman-gvproxy - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
podman - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
podman-catatonit - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
openshift (Red Hat package) - addressed in versions 4.12.0-202408131833.p0.g1eb8682.assembly.stream.el8, 4.12.0-202408131833.p0.g1eb8682.assembly.stream.el9, 4.13.0-202408092110.p0.ge0953cc.assembly.stream.el8, 4.13.0-202408092110.p0.ge0953cc.assembly.stream.el9, 4.14.0-202408071611.p0.ge826056.assembly.stream.el8, 4.14.0-202408071611.p0.ge826056.assembly.stream.el9, 4.15.0-202408091502.p0.g396c881.assembly.stream.el8, 4.15.0-202408091502.p0.g396c881.assembly.stream.el9, 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8, 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9
Red Hat OpenShift Container Platform - addressed in versions 4.12.63, 4.12.64, 4.13.45, 4.13.46, 4.13.48, 4.13.49, 4.14.32, 4.14.33, 4.14.34, 4.14.35, 4.15.28, 4.16.0, 4.16.1, 4.16.15, 4.17.0, 4.17.1
openshift-clients (Red Hat package) - addressed in versions 4.14.0-202408072340.p0.g44b3ac2.assembly.stream.el8, 4.14.0-202408072340.p0.g44b3ac2.assembly.stream.el9, 4.15.0-202408091502.p0.g1e41aa3.assembly.stream.el8, 4.15.0-202408091502.p0.g1e41aa3.assembly.stream.el9, 4.16.0-202406052127.p0.ga245041.assembly.stream.el8, 4.16.0-202406052127.p0.ga245041.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.14.0-202408072340.p0.g471f069.assembly.stream.el8, 4.14.0-202408072340.p0.g471f069.assembly.stream.el9, 4.15.0-202408091502.p0.g1e5e25d.assembly.stream.el8, 4.15.0-202408091502.p0.g1e5e25d.assembly.stream.el9, 4.16.0-202405311136.p0.ga53e9de.assembly.stream.el8, 4.16.0-202405311136.p0.ga53e9de.assembly.stream.el9
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202408091502.p0.g0d799a2.assembly.stream.el8, 4.15.0-202408091502.p0.g0d799a2.assembly.stream.el9, 4.16.0-202404301345.p0.g0e95532.assembly.stream.el8, 4.16.0-202404301345.p0.g0e95532.assembly.stream.el9
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202408091502.p0.gfc50272.assembly.stream.el8, 4.15.0-202408091502.p0.gfc50272.assembly.stream.el9, 4.16.0-202404181812.p0.g26b43df.assembly.stream.el8, 4.16.0-202404181812.p0.g26b43df.assembly.stream.el9
openshift-ansible (Red Hat package) - addressed in versions 4.16.0-202404181812.p0.g7806532.assembly.stream.el8, 4.16.0-202404181812.p0.g7806532.assembly.stream.el9
openshift4-aws-iso (Red Hat package) - update to 4.16.0-202404181812.p0.gd2acdd5.assembly.stream.el8
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.16.2
kernel (Red Hat package) - addressed in versions 4.18.0-372.118.1.el8_6, 5.14.0-284.80.1.el9_2
kernel-rt (Red Hat package) - addressed in versions 4.18.0-372.118.1.rt7.278.el8_6, 4.18.0-372.119.1.rt7.279.el8_6, 5.14.0-284.80.1.rt14.365.el9_2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.0.0
Kube Descheduler Operator for Red Hat OpenShift - update to 5.0.1
Watson CP4D Data Stores - update to 5.0.3
App Connect Enterprise Certified Container - addressed in versions 5.0.18, 11.6.0
python3x-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el8ap
python-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el9ap
Red Hat Migration Toolkit for Applications - update to 7.0.3
Red Hat Ceph Storage - addressed in versions 7.1, 8.1
Storage Protect Server - update to 8.1.23
IBM Security Verify Access - update to 10.0.9
Storage Protect Plus Container Agent - update to 10.1.12.7
Storage Protect Plus Server - update to 10.1.16.2
python3x-pillow (Red Hat package) - update to 10.3.0-1.el8ap
python-pillow (Red Hat package) - update to 10.3.0-1.el9ap
ceph (Red Hat package) - update to 19.2.1-222.el9cp
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF037, 24.0.0-IF003
python3x-gunicorn (Red Hat package) - update to 22.0.0-1.el8ap
python-gunicorn (Red Hat package) - update to 22.0.0-1.el9ap
python3x-black (Red Hat package) - update to 22.8.0-2.el8ap
python-black (Red Hat package) - update to 22.8.0-2.el9ap
Business Automation Insights - update to 24.0.0.0.1
IBM Automation Decision Services - update to 24.0.0.0.3
python3x-pyOpenSSL (Red Hat package) - update to 24.1.0-1.el8ap
python-pyOpenSSL (Red Hat package) - update to 24.1.0-1.el9ap
ovn24.03 (Red Hat package) - update to 24.03.2-19.el9fdp
python3x-cryptography (Red Hat package) - update to 42.0.5-1.el8ap
python-cryptography (Red Hat package) - update to 42.0.5-1.el9ap
cockpit-podman - update to 84.1-1
IBM Observability with Instana - update to 279
Operations Dashboard - update to 2022.2.1-24
ostree (Red Hat package) - update to 2024.1-2.el9

• https://go.dev/issue/65383
• https://go.dev/cl/569341
• https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• https://pkg.go.dev/vuln/GO-2024-2599

• Multiple vulnerabilities in Go programming language
• Multiple vulnerabilities in AdGuardHome
• SUSE update for go1.21
• SUSE update for go1.22
• SUSE update for go1.21
• Multiple vulnerabilities in Nomad
• openEuler update for golang
• Multiple vulnerabilities in Consul
• Multiple vulnerabilities in HashiCorp Consul
• Multiple vulnerabilities in Red Hat build of Cryostat 2 on RHEL 8
• Red Hat Enterprise Linux 9 update for golang
• Multiple vulnerabilities in IBM Storage Protect Plus Container Agent
• Resource exhaustion in IBM App Connect Enterprise Certified Container
• Red Hat Enterprise Linux 9 update for git-lfs
• Red Hat Enterprise Linux 8 update for git-lfs
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Red Hat Enterprise Linux 9 update for podman
• Red Hat Enterprise Linux 9 update for buildah
• Red Hat Enterprise Linux 9 update for gvisor-tap-vsock
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console 1.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.4
• Multiple vulnerabilities in Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.3
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in OpenShift Serverless Client 1.33
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in Run Once Duration Override Operator for Red Hat OpenShift 1.1
• Multiple vulnerabilities in Secondary Scheduler Operator for Red Hat OpenShift (OSSO) 1.3
• Multiple vulnerabilities in Kube Descheduler Operator for Red Hat OpenShift 5.0
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Ubuntu update for golang-1.21
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Red Hat Enterprise Linux 7 update for rhc-worker-script
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in golang-fips/go
• Amazon Linux AMI update for golang
• Gentoo update for Go
• Red Hat Enterprise Linux 9 update for golang
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15 packages
• Multiple vulnerabilities in Storage Protect Plus Server
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in Operations Dashboard
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in Red Hat OpenShift Builds 1.1
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• IBM Watson CP4D Data Stores update for Golang Go
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Run Once Duration Override Operator for Red Hat OpenShift 1.2
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• SUSE update for go1.21-openssl
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.4
• Multiple vulnerabilities in IBM Cloud Pak System
• SUSE update for go1.22-openssl
• Multiple vulnerabilities in IBM Business Automation Insights
• SUSE update for go1.22-openssl
• Red Hat Enterprise Linux 9 update for toolbox
• Ubuntu update for golang-1.17
• Ubuntu update for golang-1.18
• Multiple vulnerabilities in IBM Security Verify Access
• Multiple vulnerabilities in IBM Automation Decision Services
• Anolis OS update for go-toolset:an8 module
• Anolis OS update for git-lfs
• Anolis OS update for golang
• Anolis OS update for container-tools:an8 module
• Anolis OS update for git-lfs
• Anolis OS update for container-tools:an8 module
• Anolis OS update for container-tools:an8 module
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• openEuler update for podman
• openEuler 24.03 LTS update for etcd
• openEuler 20.03 LTS SP4 update for etcd
• Multiple vulnerabilities in Red Hat Ceph Storage 8
• Multiple vulnerabilities in Red Hat Ceph Storage 8
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in Red Hat Ceph Storage 7
• IBM Storage Ceph update for Grafana
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 7.0
• Multiple vulnerabilities in Red Hat OpenShift distributed tracing (RHOSDT) 3.2