RHSA-2023:5008HighCVSS 8.0

Red Hat Security Advisory: Red Hat build of MicroShift 4.14.0 security update

Published
October 31, 2023
Last Modified
August 6, 2026

🔗 CVE IDs covered (7)

CVE-2023-2727 →CVE-2023-2728 →CVE-2023-39318 →CVE-2023-39319 →CVE-2023-39321 →CVE-2023-39322 →CVE-2023-1260 →

📋 Description

CVE-2023-1260 — kube-apiserver: PrivEsc CVE-2023-2727 — kube-apiserver: Bypassing policies imposed by the ImagePolicyWebhook admission plugin CVE-2023-2728 — kube-apiserver: Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin CVE-2023-39318 — golang: html/template: improper handling of HTML-like comments within script contexts CVE-2023-39319 — golang: html/template: improper handling of special tags within script contexts CVE-2023-39321 — golang: crypto/tls: panic when processing post-handshake message on QUIC connections CVE-2023-39322 — golang: crypto/tls: lack of a limit on buffered post-handshake

🎯 Affected products8

  • Red Hat OpenShift Container Platform 4.14
  • microshift-0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.14
  • microshift-0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9.src as a component of Red Hat OpenShift Container Platform 4.14
  • microshift-0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.14
  • microshift-networking-0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.14
  • microshift-networking-0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.14
  • microshift-release-info-0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9.noarch as a component of Red Hat OpenShift Container Platform 4.14
  • microshift-selinux-0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9.noarch as a component of Red Hat OpenShift Container Platform 4.14

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: This issue can be mitigated by applying the patch provided for the kube-apiserver component. This patch prevents ephemeral containers from using an image that is restricted by ImagePolicyWebhook. Note: Validation webhooks, (such as Gatekeeper <https://open-policy-agent.github.io/gatekeeper-library/website/validation/allowedrepos> and Kyverno <https://kyverno.io/policies/other/allowed-image-repos/allowed-image-repos/>) can also be used to enforce the same restrictions. Workaround: This issue can be mitigated by applying the patch provided for the kube-apiserver component. The patch prevents ephemeral containers from bypassing the mountable secrets policy enforced by the ServiceAccount admission plugin.

🔗 References (55)