Red Hat 製品エラータ RHSA-2024:3467 - Security Advisory
発行日:
2024-05-29
更新日:
2024-05-29

RHSA-2024:3467 - Security Advisory

概要

Important: Red Hat OpenStack Platform 16.1 (etcd) security update

タイプ/重大度

Security Advisory: Important

Red Hat Lightspeed patch analysis

このアドバイザリーの影響を受けるシステムを特定し、修正します。

影響を受けるシステムの表示

トピック

An update for etcd is now available for Red Hat OpenStack Platform 16.1
(Train) on Red Hat Enterprise Linux (RHEL) 8.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

説明

A highly-available key value store for shared configuration

Security Fix(es):

  • Incomplete fix for CVE-2023-39325/CVE-2023-44487 in OpenStack Platform

(CVE-2024-4438)

  • Incomplete fix for CVE-2021-44716 in OpenStack Platform (CVE-2024-4437)
  • Incomplete fix for CVE-2022-41723 in OpenStack Platform (CVE-2024-4436)
  • golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)
  • golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)
  • golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)
  • golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
  • golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)
  • golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

解決策

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

影響を受ける製品

  • Red Hat OpenStack for IBM Power 16.1 ppc64le
  • Red Hat OpenStack 16.1 x86_64

修正

  • BZ - 2237773 - CVE-2023-39319 golang: html/template: improper handling of special tags within script contexts
  • BZ - 2237776 - CVE-2023-39318 golang: html/template: improper handling of HTML-like comments within script contexts
  • BZ - 2237777 - CVE-2023-39321 golang: crypto/tls: panic when processing post-handshake message on QUIC connections
  • BZ - 2237778 - CVE-2023-39322 golang: crypto/tls: lack of a limit on buffered post-handshake
  • BZ - 2253330 - CVE-2023-39326 golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests
  • BZ - 2268273 - CVE-2023-45288 golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS
  • BZ - 2279357 - CVE-2024-4436 etcd: Incomplete fix for CVE-2022-41723 in OpenStack Platform
  • BZ - 2279361 - CVE-2024-4437 etcd: Incomplete fix for CVE-2021-44716 in OpenStack Platform
  • BZ - 2279365 - CVE-2024-4438 etcd: Incomplete fix for CVE-2023-39325/CVE-2023-44487 in OpenStack Platform

Red Hat OpenStack for IBM Power 16.1

SRPM
etcd-3.3.23-16.el8ost.src.rpm SHA-256: 6e662d2d217079c8d19c3e75c4db2e9830bd3ca3fbc82f37e42464977b226818
ppc64le
etcd-3.3.23-16.el8ost.ppc64le.rpm SHA-256: 9a41b09eb84170aa293578aa883ac054906e10639098bfae1f28baf89d4324d1
etcd-debuginfo-3.3.23-16.el8ost.ppc64le.rpm SHA-256: 78247323ead6ce3ec9e239411c10db61dc213337b0cde839fd93cc9812557db3
etcd-debugsource-3.3.23-16.el8ost.ppc64le.rpm SHA-256: 75c2fca6aac5ccf3dc9d41e5e6e41f9edd2f4e288d5b8a81d9bae68e1743dd08

Red Hat OpenStack 16.1

SRPM
etcd-3.3.23-16.el8ost.src.rpm SHA-256: 6e662d2d217079c8d19c3e75c4db2e9830bd3ca3fbc82f37e42464977b226818
x86_64
etcd-3.3.23-16.el8ost.x86_64.rpm SHA-256: fc6a6476042eeefd421fc0f241d2fb70655e5fc0578d47099319ab937b64222b
etcd-debuginfo-3.3.23-16.el8ost.x86_64.rpm SHA-256: e6fe72fc0b20fa9f435f722963efa9f688f6967be1028b7a661e07a6f67aafab
etcd-debugsource-3.3.23-16.el8ost.x86_64.rpm SHA-256: e2d01ac5aae34c30a12e2e259c9e7b4115a88f1d8013fdc074c0a4b343477a9f

Red Hat のセキュリティーに関する連絡先は secalert@redhat.com です。 連絡先の詳細は https://access.redhat.com/security/team/contact/ をご覧ください。