Important: Red Hat Security Advisory: OpenShift Virtualization 4.13.5 Images security update

Red Hat OpenShift Virtualization release 4.13.5 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...

BIT-2023-39325

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

Important: Red Hat Security Advisory: Secondary Scheduler Operator for Red Hat OpenShift 1.2.0

Secondary Scheduler Operator for Red Hat OpenShift 1.2.0 The Secondary Scheduler Operator for Red Hat OpenShift is an optional operator that makes it possible to deploy a secondary scheduler by providing a scheduler image. You can run a scheduler with custom plugins without applying additional...

Important: cni-plugins

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: cni-plugins Note: This advisory is applicable to Amazo...

Important: cri-tools

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: cri-tools Note: This advisory is applicable to Amazon...

Important: golist

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: golist Note: This advisory is applicable to Amazon Lin...

Amazon Linux 2 : runc (ALASECS-2023-018)

The version of runc installed on the remote host is prior to 1.1.7-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-018 advisory. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signature...

Amazon Linux 2 : containerd (ALASECS-2023-017)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-017 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many stream...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASDOCKER-2023-034)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.7.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2023-034 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation c...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASNITRO-ENCLAVES-2023-033)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.7.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-033 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2023-016)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.27.2.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-016 advisory. An issue was found in libcurl which allows cookies to be inserted into a running program if specif...

SUSE SLES15 / openSUSE 15 Security Update : nodejs10 (SUSE-SU-2023:4295-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4295-1 advisory. - CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. bsc1216190 Tenable has extracted the preceding description block...

Amazon Linux 2 : docker (ALASECS-2023-019)

The version of docker installed on the remote host is prior to 20.10.25-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-019 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Templates did not properly consider backticks...

[SECURITY] [DLA 3638-1] h2o security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3638-1 [email protected] https://www.debian.org/lts/security/ Anton Gladky October 29, 2023 https://wiki.debian.org/LTS -...

Huawei EulerOS: Security Advisory for nghttp2 (EulerOS-SA-2023-3015)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-5540-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-3641-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-5540-1 : jetty9 - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5540 advisory. - Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer...

Debian dla-3641 : jetty9 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3641 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3641-1 [email protected]...

Debian dla-3638 : h2o - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3638 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3638-1 [email protected] https://www.debian.org/lts/security/...