RHSA-2023:3943MediumCVSS 9.8

Red Hat Security Advisory: ACS 4.1 enhancement and security update

Published
June 29, 2023
Last Modified
August 31, 2026

🔗 CVE IDs covered (6)

CVE-2022-27191 →CVE-2022-41723 →CVE-2023-24534 →CVE-2023-24536 →CVE-2023-24537 →CVE-2023-24538 →

📋 Description

CVE-2022-27191 — golang: crash in a golang.org/x/crypto/ssh server CVE-2022-41723 — golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding CVE-2023-24534 — golang: net/http, net/textproto: denial of service from excessive memory allocation CVE-2023-24536 — golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption CVE-2023-24537 — golang: go/parser: Infinite loop in parsing CVE-2023-24538 — golang: html/template: backticks not treated as string delimiters

🎯 Affected products34

  • RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-central-db-rhel8@sha256:20fc9c1f2c050968b0f2d6b3011c5ced868fb7b05e6601a6a835bf681be30f09_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-central-db-rhel8@sha256:2238b2405110f100d7e499fbb6313df6a41a543e07032f04c86b073f5472f73e_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-central-db-rhel8@sha256:4616744855907343d0be7fa1787e35b281ef3b66e5a23fab101b5e128f52ad3b_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-collector-rhel8@sha256:38ab36e0243b00b1cace2970c8f5588b21dfd0330d25d4ed703823f7f4bf3b52_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-collector-rhel8@sha256:aa41f9e3f9a85fbae062aee5939f091b0b598aa0aa4c3771681fd356a6a5de18_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-collector-rhel8@sha256:b671657f95b1bcbaf1a445e3387e10367804c0d7493cb622d7057b31c1e0c28b_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:4d3d6c7000e3ea08d226aab83a57dfe6fa2da97b8d685d3b0c4ec5b5f1f5c462_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:6c84697eccfaf089e43bcbef2fa9a2a789b8c5d5bc065d16a0c8e5542891a5b1_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:9b0c513eb212ca750612c4f272e694dcb8c45561edafaa1c24b993e561399c3b_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-main-rhel8@sha256:222b3ba1cf2a40cb31198091b667f351a78a65db1ed7537323c2e477c9878124_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-main-rhel8@sha256:378d9937f14520c62e0badb320cc755806d2a517873b12d2f9f08fb857562433_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-main-rhel8@sha256:7e86701d783471db34743c44d527f55b02bb922b3bc270ce4c9f749885991730_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-operator-bundle@sha256:8691b2e8129e6b872530cd15f025a0e91824defb32f828907596e055f40cb1f6_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-operator-bundle@sha256:977f07546dc7d0d8f5501e5fa64d311d8071d491b7ea4eb5f9577f88be890dac_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-operator-bundle@sha256:eebfa0e319e1d78c403da776182bb00bf0f7367f4454749d414ff5ad75c4469c_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-rhel8-operator@sha256:b013aabfb65b28c421ad3327a80a4c724a552e8f814311c16c7555f576b39393_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-rhel8-operator@sha256:b366864281deb4b324c282380db13cfe0f0933361ebc706988a2cbaa403fe37a_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-rhel8-operator@sha256:d956e88f9a36628eeaf2cb5b299ac42016efa84d3bc14c77308b15afc1e90744_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-roxctl-rhel8@sha256:9b0e2af7848795f02e0b6fe75990810b93f0bd684d908c8f6309069fd876bd83_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-roxctl-rhel8@sha256:e65f2cc299a72c836fcad4725fad101e9cbce840cdfbb5e998f79ae5a16ca4df_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ed0d8c9651090b6ddc7885a4a1542e636d35d7bc7644db1a95a16e10fa2a85ea_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:0fc086b3aed2f0511d3b994a07a2ba3fcfdfa2a12b29d151e3b2ccbeb639a891_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:3e51c4ac5ca73a90557824e65408ae5fe70e23bb67ed035f54e92af34e9f0e24_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b9eefd01c7b20196c13b474d2dba3cc6ba2d3884da8614702538dd007c937f89_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:3566bc3cd7e1b8a1e23c965add5d037de5ec336e680fb7a241665a52bbd60211_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:b2b95e98c75a4c78669c0720e03e6dddf6c3207a8af2f0265414313c4b0011ad_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:c1fadaff2477a1b5911c66488450112d2bec18fb3c98982ae191812745d6c841_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-rhel8@sha256:0bb05a07414e63cfa925adb1a19bdaf63da53fb54f3d98a21ecb4c4f4f87311d_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-rhel8@sha256:29ae0c58a01fc6439da2dd3b8ed3651ec23211dd4ce3be8a6f169b2fe2dcfecb_s390x as a component of RHACS 4.1 for RHEL 8
  • +4 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (10)