RHSA-2023:1655CriticalCVSS 9.8

Red Hat Security Advisory: OpenShift Container Platform 4.10.56 security update

Published
April 12, 2023
Last Modified
August 4, 2026

🔗 CVE IDs covered (10)

CVE-2023-27903 →CVE-2022-31690 →CVE-2022-31692 →CVE-2023-24422 →CVE-2023-25725 →CVE-2023-27898 →CVE-2023-27904 →CVE-2022-3172 →CVE-2022-42889 →CVE-2023-27899 →

📋 Description

CVE-2022-3172 — kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) CVE-2022-31690 — spring-security-oauth2-client: Privilege Escalation in spring-security-oauth2-client CVE-2022-31692 — spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security CVE-2022-42889 — apache-commons-text: variable interpolation RCE CVE-2023-24422 — jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin CVE-2023-25725 — haproxy: request smuggling attack in HTTP/1 header parsing CVE-2023-27898 — Jenkins: XSS vulnerability in plugin manager CVE-2023-27899 — Jenkins: Temporary plugin file created with insecure permissions CVE-2023-27903 — Jenkins: Temporary file parameter created with insecure permissions CVE-2023-27904 — Jenkins: Information disclosure through error stack traces related to agents

🎯 Affected products184

  • Red Hat OpenShift Container Platform 4.10
  • bpftool-0:4.18.0-305.85.1.el8_4.aarch64 as a component of Red Hat OpenShift Container Platform 4.10
  • bpftool-0:4.18.0-305.85.1.el8_4.ppc64le as a component of Red Hat OpenShift Container Platform 4.10
  • bpftool-0:4.18.0-305.85.1.el8_4.s390x as a component of Red Hat OpenShift Container Platform 4.10
  • bpftool-0:4.18.0-305.85.1.el8_4.x86_64 as a component of Red Hat OpenShift Container Platform 4.10
  • bpftool-debuginfo-0:4.18.0-305.85.1.el8_4.aarch64 as a component of Red Hat OpenShift Container Platform 4.10
  • bpftool-debuginfo-0:4.18.0-305.85.1.el8_4.ppc64le as a component of Red Hat OpenShift Container Platform 4.10
  • bpftool-debuginfo-0:4.18.0-305.85.1.el8_4.s390x as a component of Red Hat OpenShift Container Platform 4.10
  • bpftool-debuginfo-0:4.18.0-305.85.1.el8_4.x86_64 as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-0:1.23.5-8.rhaos4.10.gitcc8441d.el7.src as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-0:1.23.5-8.rhaos4.10.gitcc8441d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.s390x as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.src as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-debuginfo-0:1.23.5-8.rhaos4.10.gitcc8441d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-debuginfo-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-debuginfo-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-debuginfo-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.s390x as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-debuginfo-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-debugsource-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-debugsource-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-debugsource-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.s390x as a component of Red Hat OpenShift Container Platform 4.10
  • cri-o-debugsource-0:1.23.5-8.rhaos4.10.gitcc8441d.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.10
  • haproxy-0:2.2.19-4.el8.src as a component of Red Hat OpenShift Container Platform 4.10
  • haproxy-debugsource-0:2.2.19-4.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.10
  • haproxy-debugsource-0:2.2.19-4.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.10
  • haproxy-debugsource-0:2.2.19-4.el8.s390x as a component of Red Hat OpenShift Container Platform 4.10
  • haproxy-debugsource-0:2.2.19-4.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.10
  • +154 more not shown

✅ Remediation

For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html Workaround: This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.

🔗 References (13)