Important: Red Hat Security Advisory: Node Health Check Operator 0.6.1 security update

This is an updated version for the node-healthcheck-must-gather-container, the node-healthcheck-operator-bundle-container, the node-healthcheck-operator-container, and the node-remediation-console-container. It is now available for Node Health Check Operator 0.6 for RHEL 8. Red Hat Product Securi...

Important: Red Hat Security Advisory: Node Health Check Operator 0.4.1

This is an updated version of the Node Health Check Operator. This Operator is delivered by Red Hat Workload Availability. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

Important: Red Hat Security Advisory: openshift-pipelines-client security update

An update for openshift-pipelines-client is now available for OpenShift-Pipelines-1.11-RHEL-8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: openshift-gitops-kam security update

An update for openshift-gitops-kam is now available for Red Hat OpenShift GitOps 1.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: nghttp2 security update

An update for nghttp2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests

A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache...

Rocky Linux 8 : nodejs:10 (RLSA-2019:2925)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:2925 advisory. - In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service DoS...

Rocky Linux 8 : container-tools:1.0 (RLSA-2019:4273)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:4273 advisory. - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2...

Fedora 39 : golang-x-net (2023-dc7cceb285)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-dc7cceb285 advisory. Automatic update for golang-x-net-0.14.0-1.fc39. Changelog Mon Aug 7 2023 Mikel Olasagasti Uranga - 0.14.0-1 - Update to 0.14.0 - Closes rhbz2229647...

RHEL 9 : podman (RHSA-2023:6474)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6474 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use contain...

Fedora 39 : golang-github-mailru-easyjson (2023-7abdd861d6)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-7abdd861d6 advisory. Automatic update for golang-github-mailru-easyjson-0.7.7-1.fc39. Changelog Mon Jul 10 2023 Mikel Olasagasti Uranga - 0.7.7-1 - Update to 0.7.7 - Closes...

Fedora 39 : rclone (2023-2f0957b051)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-2f0957b051 advisory. Automatic update for rclone-1.63.1-1.fc39. Changelog Mon Jul 31 2023 Mikel Olasagasti Uranga - 1.63.1-1 - Update to 1.63.1 - Closes rhbz2155701...

Fedora 39 : trafficserver (2023-1caffb88af)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1caffb88af advisory. Update to upstream 9.2.3 Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456 Tenable has extracted the preceding description block directly from...

Fedora 39 : nodejs18 (2023-dbe64661af)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-dbe64661af advisory. 2023-10-13, Version 18.18.2 'Hydrogen' LTS, @RafaelGSS This is a security release. Notable Changes The following CVEs are fixed in this release:...

Fedora 39 : golang (2023-822aab0a5a)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-822aab0a5a advisory. This update includes a security fix to the net/http package. Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 39 : cachelib / fb303 / fbthrift / fizz / folly / mcrouter / mvfst / etc (2023-7934802344)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-7934802344 advisory. Update Folly stack to the latest 2023.10.16.00 tag proxygen: Security fix for CVE-2023-44487 Tenable has extracted the preceding description block directly...

Fedora 37 : mod_http2 (2023-c0c6a91330)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c0c6a91330 advisory. - New version 2.0.25 - Security update Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

RHEL 9 : containernetworking-plugins (RHSA-2023:6402)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6402 advisory. The Container Network Interface CNI project consists of a specification and libraries for writing plug- ins for configuring network interfac...

RHEL 9 : skopeo (RHSA-2023:6363)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6363 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and...