RHSA-2023:3918HighCVSS 9.8

Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.1.5 security and bug fix update

Published
June 29, 2023
Last Modified
September 22, 2026

🔗 CVE IDs covered (8)

CVE-2023-24534 →CVE-2023-24536 →CVE-2023-24537 →CVE-2023-24538 →CVE-2023-24539 →CVE-2023-24540 →CVE-2023-29400 →CVE-2022-41723 →

📋 Description

CVE-2022-41723 — golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding CVE-2023-24534 — golang: net/http, net/textproto: denial of service from excessive memory allocation CVE-2023-24536 — golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption CVE-2023-24537 — golang: go/parser: Infinite loop in parsing CVE-2023-24538 — golang: html/template: backticks not treated as string delimiters CVE-2023-24539 — golang: html/template: improper sanitization of CSS values CVE-2023-24540 — golang: html/template: improper handling of JavaScript whitespace CVE-2023-29400 — golang: html/template: improper handling of empty HTML attributes

🎯 Affected products37

  • 8Base-OADP-1.1
  • oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:232797593d0ea5323f913c902ac7bd25bbe1eacdb40b00deaf9bbcd9306bf4e9_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:aa58ca1500ddb603bc9f39eba981584cd38682eab092ce06ec951a078a3dc0a6_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:b5ac15e683479a1524dfa55db10a8c84e362e6734f0d82d62ce724dfd76779e2_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-mustgather-rhel8@sha256:83d13ab990fc72c63c51a008a13fe341a555dfaec96494d25f5b7cbd5a0eafb1_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-mustgather-rhel8@sha256:b0215bed64f78192b9d7a8e4904efdbef9408296806d7fb6b86927b0cbd67a79_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-mustgather-rhel8@sha256:c0a9d5bbd97613ca2d26bd4315b55ffc6512fa429c0cdec5da77fe2fb8d254b9_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-operator-bundle@sha256:174e673e1e9b09714ac89082c01e84bf9e77c7d52f65bbe3da156e4467ff6e07_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-operator-bundle@sha256:91e02a2cd94a94354294e16b3a8495175907c9d07e1f7965febe1179d36c9940_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-operator-bundle@sha256:a3348b782dd897ef822bdf885db8c61e24278dde0520646e54270fec53d10f34_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-rhel8-operator@sha256:36882e2b4183bd2d0e58acb59e49004db1c2accd1f4e6cc01dfc2ca10cbbda19_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-rhel8-operator@sha256:5e9ef29577268fc0bafa30e84de8f79c5141df76eefe995da2a2a201a92e5aef_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-rhel8-operator@sha256:cdcb5d1b32410973779aed6cb760c016fe2035dbcae41dde6707045bbf4e97c6_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-aws-rhel8@sha256:3e4af775f289789e0dce2ac73c07d6d5a101c77970b5f70e88a4cff6e2fbc3dd_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-aws-rhel8@sha256:60a01a5762ea173f150f6ccd6f8bfd1f1e17aed1f4865f9161d0d06e3c490ca7_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-aws-rhel8@sha256:a5702782be3fdf763b47c734d107d853c2b8f3f831c45d34dd686c19e2b295ff_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-csi-rhel8@sha256:2a8a8c64cb71f52559e53b9dddaeaee97b8067a7b2f996cde2e1ca2e14f25e55_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-csi-rhel8@sha256:37002fe133ff5853c97eb41e9d5e57dfb882f2b9150dfe945f965f78fbe3b1e4_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-csi-rhel8@sha256:38e0bf9d9f589e93335d477e23fe2838ad2ef138472d66887d7343b720081c19_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:195a154a41e6a7a4176475470aa1058e7ab171cb5ffd0c998009ac022ba810b2_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:5e26431bc81545c21b1c3b87dd42e267773c4221213d478c04e0b8809559201c_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:b3792c8e92add196de5d06cdd88eb8e9d02fcdb9ce15c1a9a362241018caf6db_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:04c0ba8b1660eaa87f5e22291904b6e98442056270cfb134a243943742595e30_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1b8f8b7b03f5dc4ca2fbeec13eb4b99e5bec1f09daf7b04c982ba1324611c6f3_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:37d6701003b9e5f58795d85267d1ca1fd9687981abe784075d9c7ba5a7a036c5_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-rhel8@sha256:17ae407841f29a5bbf3e72d25acc883150929ce91fc6384fc81e8d7977eecf42_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-rhel8@sha256:2d58a2e20d7a0553ce843a6b43b2df1e7924d5b2cb19372a276ebde6644e8eb5_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-rhel8@sha256:d695407dd931000091e7a19ea693608e99985c84bfae95a94d8d111313b8e542_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-restic-restore-helper-rhel8@sha256:66bee327e86ddae9b69e362e520278bd8cb6a8b7f9756c3a55faf76d02486ab1_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-restic-restore-helper-rhel8@sha256:7e212da871132c319750a6513e9b98a836b6d670dfeeb0ca2050b0fe959bbb9e_ppc64le as a component of 8Base-OADP-1.1
  • +7 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (11)