RHSA-2023:3624HighCVSS 9.8

Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.10 security and bug fix update

Published
June 15, 2023
Last Modified
September 22, 2026

🔗 CVE IDs covered (5)

CVE-2023-24536 →CVE-2023-24537 →CVE-2023-24538 →CVE-2023-24540 →CVE-2023-24534 →

📋 Description

CVE-2023-24534 — golang: net/http, net/textproto: denial of service from excessive memory allocation CVE-2023-24536 — golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption CVE-2023-24537 — golang: go/parser: Infinite loop in parsing CVE-2023-24538 — golang: html/template: backticks not treated as string delimiters CVE-2023-24540 — golang: html/template: improper handling of JavaScript whitespace

🎯 Affected products18

  • 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-controller-rhel8@sha256:fdd27f3cb68a541b704fa014e7ea564583307743a4d31032cad01268dddf55bc_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-hook-runner-rhel8@sha256:9fea1718dc2fe0dd2735750df6d16921086e2593da3c8de2272584f1b976c6ee_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-legacy-rhel8-operator@sha256:ea7911f8d680f1a827fdd29fc67c5b5d0d5f420fd09baa930809ef4fa38ae6ab_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-log-reader-rhel8@sha256:d768e09a2ab2d6906d63612488d32180d1c6270804c0bcc9fa6f89bbd7f04193_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-must-gather-rhel8@sha256:fdf17820034efd0f7f76274798518bcea6c9483c8de8804f5a56b651ef77e717_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-openvpn-rhel8@sha256:edfff81bc56194aea84e3b80fa550b439c266df3fc81c58c111e5972b670f7ae_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-operator-bundle@sha256:20d278777ec6758913a21946f57ea207fd924f84085f6bf9ea51cd94eaae24ca_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-registry-rhel8@sha256:3200f7f9624ad8aee46d0e3ebf6c04464b277cac4da67075863c2f4f0b33aaff_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-rhel8-operator@sha256:41c5da49059d19beb97ec9d9fd4542120af73d488ffdc1d611c9774bf1f7c79a_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b172c46f467a7813bed75b04dd82c24be0092e1ea2c74a45a8f82ce895876e81_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-ui-rhel8@sha256:926a4c07b2a4223264fa1455f3f056d94a9dc52885713978ff8586e8caa2eff5_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-plugin-for-aws-rhel8@sha256:6097ccca550816d040055dd4878d17cc0996d47a436f06296fe5d26c5862e1f5_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8@sha256:1b4eb48d9aa6b63cd6409fa5b77eb769a2ed4bc257a4058d1a07a66ea95039a5_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8@sha256:9ef09a93b6910806b2952b9d50c5a61ae6f2c7284c439f61bf303d2e893c8c22_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-restic-restore-helper-rhel8@sha256:6da71292aa6f83b0c6cc113c6c05b2224ba2b3f90de62d69843cf6399558551e_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-rhel8@sha256:346fa63bcbdc03896e91b2ee3318e062b4deb7fe9183135c7841d0da69c3690c_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-velero-plugin-rhel8@sha256:916d5fd70f5eb58931927d44e05e2287ce85f04ac3bdefde78b6522214a0286e_amd64 as a component of 8Base-RHMTC-1.7

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (11)