Important: Red Hat Security Advisory: Node Health Check Operator 0.6.1 security update

This is an updated version for the node-healthcheck-must-gather-container, the node-healthcheck-operator-bundle-container, the node-healthcheck-operator-container, and the node-remediation-console-container. It is now available for Node Health Check Operator 0.6 for RHEL 8. Red Hat Product Securi...

Important: Red Hat Security Advisory: Node Health Check Operator 0.4.1

This is an updated version of the Node Health Check Operator. This Operator is delivered by Red Hat Workload Availability. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

Important: Red Hat Security Advisory: openshift-pipelines-client security update

An update for openshift-pipelines-client is now available for OpenShift-Pipelines-1.11-RHEL-8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: openshift-gitops-kam security update

An update for openshift-gitops-kam is now available for Red Hat OpenShift GitOps 1.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: nghttp2 security update

An update for nghttp2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests

A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache...

Fedora 39 : golang-github-cloudflare-cfssl (2023-b1cebc5424)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-b1cebc5424 advisory. Automatic update for golang-github-cloudflare-cfssl-1.6.4-1.fc39. Changelog Wed Jun 28 2023 Mikel Olasagasti Uranga - 1.6.4-1 - Update to 1.6.4 - Closes...

Fedora 39 : golang-honnef-tools (2023-65f2712f28)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-65f2712f28 advisory. Automatic update for golang-honnef-tools-2023.1.3-1.20230802git0e3cc29.fc39. Changelog Wed Aug 2 2023 Mikel Olasagasti Uranga - 2023.1.3-1 - Update to 2023.1...

Fedora 39 : htmltest (2023-946dfaf17f)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-946dfaf17f advisory. Security fix for CVE-2022-41717 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Fedora 39 : golang-github-onsi-ginkgo-2 (2023-9ca66e00a2)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-9ca66e00a2 advisory. Automatic update for golang-github-onsi-ginkgo-2-2.11.0-1.fc39. Changelog Thu Jun 22 2023 Mikel Olasagasti Uranga - 2.11.0-1 - Update to 2.11.0 - Closes...

Rocky Linux 8 : container-tools:1.0 (RLSA-2019:4273)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:4273 advisory. - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2...

Rocky Linux 8 : container-tools:rhel8 (RLSA-2019:4269)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:4269 advisory. - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.g...

RHEL 9 : containernetworking-plugins (RHSA-2023:6402)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6402 advisory. The Container Network Interface CNI project consists of a specification and libraries for writing plug- ins for configuring network interfac...

Important: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 For more details about the security issues, including the impact, a CV...

Fedora 39 : trafficserver (2023-1caffb88af)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1caffb88af advisory. Update to upstream 9.2.3 Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456 Tenable has extracted the preceding description block directly from...

Fedora 39 : nodejs20 (2023-7b52921cae)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7b52921cae advisory. 2023-10-13, Version 20.8.1 Current, @RafaelGSS This is a security release. Notable Changes The following CVEs are fixed in this release:...

ROS-20231107-01

Vulnerability of HTTP/2 protocol implementation is related to the possibility of forming a stream of requests within an already established network connection without opening new network connections and without confirming receipt of requests. The vulnerability of the HTTP/2 protocol implementatio...

Fedora 39 : golang-github-schollz-croc (2023-4c1050f439)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-4c1050f439 advisory. Automatic update for golang-github-schollz-croc-9.6.4-1.fc39. Changelog Fri May 19 2023 Mikel Olasagasti Uranga - 9.6.4-1 - Update to 9.6.4 - Closes...

Fedora 39 : mod_http2 (2023-492b7be466)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-492b7be466 advisory. - New version 2.0.25 - Security update Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...