RHSA-2023:5479HighCVSS 8.1

Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.30.1 security update

Published
October 5, 2023
Last Modified
November 7, 2026

🔗 CVE IDs covered (1)

CVE-2023-4853 →

📋 Description

CVE-2023-4853 — quarkus: HTTP security policy bypass

🎯 Affected products5

  • Red Hat OpenShift Serverless 1.0
  • openshift-serverless-clients-0:1.9.2-3.el8.ppc64le as a component of Red Hat OpenShift Serverless 1.0
  • openshift-serverless-clients-0:1.9.2-3.el8.s390x as a component of Red Hat OpenShift Serverless 1.0
  • openshift-serverless-clients-0:1.9.2-3.el8.src as a component of Red Hat OpenShift Serverless 1.0
  • openshift-serverless-clients-0:1.9.2-3.el8.x86_64 as a component of Red Hat OpenShift Serverless 1.0

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Use a ‘deny’ wildcard for base paths, then authenticate specifics within that: Examples: ``` deny: /* authenticated: /services/* ``` or ``` deny: /services/* roles-allowed: /services/rbac/* ``` NOTE: Products are only vulnerable if they use (or allow use of) path-based HTTP policy configuration. Products may also be affected–shipping the component in question–without being vulnerable (“affected at reduced impact”). See https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 for more detailed mitigations.

🔗 References (9)