RHSA-2023:4627HighCVSS 9.8

Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update

Published
August 14, 2023
Last Modified
September 7, 2026

🔗 CVE IDs covered (20)

CVE-2022-4492 →CVE-2022-41725 →CVE-2023-24532 →CVE-2023-24534 →CVE-2023-24540 →CVE-2021-46877 →CVE-2023-24536 →CVE-2023-24537 →CVE-2023-24538 →CVE-2022-41721 →CVE-2022-41854 →CVE-2022-41881 →CVE-2023-2798 →CVE-2023-24539 →CVE-2023-26125 →CVE-2023-29400 →CVE-2022-41723 →CVE-2022-41724 →CVE-2023-22899 →CVE-2023-34104 →

📋 Description

CVE-2021-46877 — jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode CVE-2022-4492 — undertow: Server identity in https connection is not checked by the undertow client CVE-2022-41721 — x/net/http2/h2c: request smuggling CVE-2022-41723 — golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding CVE-2022-41724 — golang: crypto/tls: large handshake records may cause panics CVE-2022-41725 — golang: net/http, mime/multipart: denial of service from excessive resource consumption CVE-2022-41854 — dev-java/snakeyaml: DoS via stack overflow CVE-2022-41881 — codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS CVE-2023-2798 — htmlUnit: Stack overflow crash causes Denial of Service (DoS) CVE-2023-22899 — zip4j: does not always check the MAC when decrypting a ZIP archive CVE-2023-24532 — golang: crypto/internal/nistec: specific unreduced P-256 scalars produce incorrect results CVE-2023-24534 — golang: net/http, net/textproto: denial of service from excessive memory allocation CVE-2023-24536 — golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption CVE-2023-24537 — golang: go/parser: Infinite loop in parsing CVE-2023-24538 — golang: html/template: backticks not treated as string delimiters CVE-2023-24539 — golang: html/template: improper sanitization of CSS values CVE-2023-24540 — golang: html/template: improper handling of JavaScript whitespace CVE-2023-26125 — golang-github-gin-gonic-gin: Improper Input Validation CVE-2023-29400 — golang: html/template: improper handling of empty HTML attributes CVE-2023-34104 — fast-xml-parser: Regex Injection via Doctype Entities

🎯 Affected products7

  • MTA 6.2 for RHEL 8
  • mta/mta-hub-rhel9@sha256:5cc1613cb869bab75faa5ea2798ab5f34238192b397d3c942789b4242a8a815a_amd64 as a component of MTA 6.2 for RHEL 8
  • mta/mta-operator-bundle@sha256:3165133f54da89d0e2b897a8069db7d17a4d956b712f84eb320c083506c24469_amd64 as a component of MTA 6.2 for RHEL 8
  • mta/mta-pathfinder-rhel9@sha256:8cbce6bd4bc17d78e532477bbb4d8c6d02a5f0d0a823b6a9f20c072ff66fdb26_amd64 as a component of MTA 6.2 for RHEL 8
  • mta/mta-rhel8-operator@sha256:c33386019c431eaeac3559226353b5a50cd54c03a2975bde02f6a66427fca893_amd64 as a component of MTA 6.2 for RHEL 8
  • mta/mta-ui-rhel9@sha256:d393b1ae0968bd8710a8e58c0e74d293c58b804fb5e6cbb9434520c888a80587_amd64 as a component of MTA 6.2 for RHEL 8
  • mta/mta-windup-addon-rhel9@sha256:5a6e25695fbf883d6c02cd8b933a2a482e3e18ec70e86be0db576a107ff65a84_amd64 as a component of MTA 6.2 for RHEL 8

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (104)