SB2023060850 - OpenShift Container Platform 4.12 update for golang
Published: June 8, 2023 Updated: August 16, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Code Injection (CVE-ID: CVE-2023-24540)
The vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to improper input validation when processing whitespace characters. A remote attacker can send a specially crafted request and execute arbitrary JavaScript code.
2) Link following (CVE-ID: CVE-2023-25652)
The vulnerability allows a local user to escalate privileges on the system.
The
vulnerability exists due to a symlink following issue in "git apply --reject". A local user can
create a specially crafted symbolic link to write files outside of the worktree.
3) Insufficient verification of data authenticity (CVE-ID: CVE-2023-25815)
The vulnerability allows a local user to tamper with Git messages.
The vulnerability exists due to the way Git processes localized messages. A local user on a multi-user machine can display a malicious message to the user.
4) Input validation error (CVE-ID: CVE-2023-29007)
The vulnerability allows an attacker to tamper with Git configuration.
The vulnerability exists due to insufficient input validation in "git submodule deinit" when renaming or deleting a section from a configuration file. A remote attacker can trick the victim into running the command a malicious configuration file and tamper with Git configuration on the affected system.
Remediation
Install update from vendor's website.