Vulnerability-Lookup

RHEA-2023:5445

Vulnerability from csaf_redhat - Published: 2023-10-04 14:36 - Updated: 2026-10-31 17:16

Summary

Red Hat Enhancement Advisory: OpenShift Container Platform 4.12.35 CNF vRAN extras update

Severity

Moderate

Notes

Topic: An update for ztp-site-generate-container, topology-aware-lifecycle-manager and bare-metal-event-relay is now available for Red Hat OpenShift Container Platform 4.12.

Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the extra low-latency container images for Red Hat OpenShift Container Platform 4.12. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHBA-2023:5321 All OpenShift Container Platform users are advised to upgrade to these updated packages and images.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-37788

A flaw was found in goproxy, which is vulnerable to a denial of service caused by improper input validation. This flaw allows a remote attacker can cause the goproxy server to crash by sending a specially crafted HTTP request to the HTTPS page, replacing the path "/" with an asterisk "*".

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: 8Base-RHOSE-4.12:openshift4/bare-metal-event-relay-operator-bundle@sha256:e3035e443ad6c4f0364d175cf2284410cc5a2c1a5b39b6522912330c3114d6c3_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-RHOSE-4.12:openshift4/bare-metal-event-relay-rhel8-operator@sha256:c1110b108e61aef37635ec53ef168fb469e13bfbc080f9b12a698913c5b9c036_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-RHOSE-4.12:openshift4/baremetal-hardware-event-proxy-rhel8@sha256:96503726fa4030b2e8cc78b3216c9803d8fbd954e2b13eaed1bca5e58b5ada49_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:f8a6eae2d319c8f55c44b194d8f1bbed97a5e85fd23d6ad829719399f5fce9fb_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:b59d0ec9780035bdcd99ce665a772d44ef80bef80a01b7e93af032993db0612b_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:9ad40d51d639ea088071128765959c905fd37ab888a5160db68b3f1f508902cb_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:0b76c21c61cd49eefa986cdbe465ee64cb4e872828ad36004c68cfa5bfa9c85c_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-RHOSE-4.12:openshift4/ztp-site-generate-rhel8@sha256:bb8ee87c7570a4e43fe2fa81f87b4ffa927ecd7156a22cdbae3405563a918c1d_amd64	—	Vendor Fix fix

Threats

Impact Moderate

References

12 references

URL	Category
https://access.redhat.com/errata/RHEA-2023:5445	self
https://issues.redhat.com/browse/OCPBUGS-16416	external
https://issues.redhat.com/browse/OCPBUGS-17756	external
https://issues.redhat.com/browse/OCPBUGS-18671	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2023-37788	self
https://bugzilla.redhat.com/show_bug.cgi?id=2224245	external
https://www.cve.org/CVERecord?id=CVE-2023-37788	external
https://nvd.nist.gov/vuln/detail/CVE-2023-37788	external
https://github.com/advisories/GHSA-4r8x-2p26-976p	external
https://github.com/elazarl/goproxy/issues/502	external
https://github.com/elazarl/goproxy/pull/507	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for ztp-site-generate-container, topology-aware-lifecycle-manager and bare-metal-event-relay is now available for Red Hat OpenShift Container Platform 4.12.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nThis advisory contains the extra low-latency container images for Red Hat OpenShift Container Platform 4.12. See the following advisory for the container images for this release:\n\nhttps://access.redhat.com/errata/RHBA-2023:5321\n\nAll OpenShift Container Platform users are advised to upgrade to these updated packages and images.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHEA-2023:5445",
        "url": "https://access.redhat.com/errata/RHEA-2023:5445"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-16416",
        "url": "https://issues.redhat.com/browse/OCPBUGS-16416"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-17756",
        "url": "https://issues.redhat.com/browse/OCPBUGS-17756"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-18671",
        "url": "https://issues.redhat.com/browse/OCPBUGS-18671"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhea-2023_5445.json"
      }
    ],
    "title": "Red Hat Enhancement Advisory: OpenShift Container Platform 4.12.35 CNF vRAN extras update",
    "tracking": {
      "current_release_date": "2026-10-31T17:16:23+00:00",
      "generator": {
        "date": "2026-10-31T17:16:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHEA-2023:5445",
      "initial_release_date": "2023-10-04T14:36:39+00:00",
      "revision_history": [
        {
          "date": "2023-10-04T14:36:39+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-10-04T14:36:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-31T17:16:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.12",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.12",
                  "product_id": "8Base-RHOSE-4.12",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.12::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift4/bare-metal-event-relay-operator-bundle@sha256:e3035e443ad6c4f0364d175cf2284410cc5a2c1a5b39b6522912330c3114d6c3_amd64",
                "product": {
                  "name": "openshift4/bare-metal-event-relay-operator-bundle@sha256:e3035e443ad6c4f0364d175cf2284410cc5a2c1a5b39b6522912330c3114d6c3_amd64",
                  "product_id": "openshift4/bare-metal-event-relay-operator-bundle@sha256:e3035e443ad6c4f0364d175cf2284410cc5a2c1a5b39b6522912330c3114d6c3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bare-metal-event-relay-operator-bundle@sha256:e3035e443ad6c4f0364d175cf2284410cc5a2c1a5b39b6522912330c3114d6c3?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/bare-metal-event-relay-operator-bundle\u0026tag=v4.12.5-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift4/bare-metal-event-relay-rhel8-operator@sha256:c1110b108e61aef37635ec53ef168fb469e13bfbc080f9b12a698913c5b9c036_amd64",
                "product": {
                  "name": "openshift4/bare-metal-event-relay-rhel8-operator@sha256:c1110b108e61aef37635ec53ef168fb469e13bfbc080f9b12a698913c5b9c036_amd64",
                  "product_id": "openshift4/bare-metal-event-relay-rhel8-operator@sha256:c1110b108e61aef37635ec53ef168fb469e13bfbc080f9b12a698913c5b9c036_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bare-metal-event-relay-rhel8-operator@sha256:c1110b108e61aef37635ec53ef168fb469e13bfbc080f9b12a698913c5b9c036?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/bare-metal-event-relay-rhel8-operator\u0026tag=v4.12.5-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift4/baremetal-hardware-event-proxy-rhel8@sha256:96503726fa4030b2e8cc78b3216c9803d8fbd954e2b13eaed1bca5e58b5ada49_amd64",
                "product": {
                  "name": "openshift4/baremetal-hardware-event-proxy-rhel8@sha256:96503726fa4030b2e8cc78b3216c9803d8fbd954e2b13eaed1bca5e58b5ada49_amd64",
                  "product_id": "openshift4/baremetal-hardware-event-proxy-rhel8@sha256:96503726fa4030b2e8cc78b3216c9803d8fbd954e2b13eaed1bca5e58b5ada49_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/baremetal-hardware-event-proxy-rhel8@sha256:96503726fa4030b2e8cc78b3216c9803d8fbd954e2b13eaed1bca5e58b5ada49?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/baremetal-hardware-event-proxy-rhel8\u0026tag=v4.12.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:f8a6eae2d319c8f55c44b194d8f1bbed97a5e85fd23d6ad829719399f5fce9fb_amd64",
                "product": {
                  "name": "openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:f8a6eae2d319c8f55c44b194d8f1bbed97a5e85fd23d6ad829719399f5fce9fb_amd64",
                  "product_id": "openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:f8a6eae2d319c8f55c44b194d8f1bbed97a5e85fd23d6ad829719399f5fce9fb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topology-aware-lifecycle-manager-operator-bundle@sha256:f8a6eae2d319c8f55c44b194d8f1bbed97a5e85fd23d6ad829719399f5fce9fb?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle\u0026tag=v4.12.6-15"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:0b76c21c61cd49eefa986cdbe465ee64cb4e872828ad36004c68cfa5bfa9c85c_amd64",
                "product": {
                  "name": "openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:0b76c21c61cd49eefa986cdbe465ee64cb4e872828ad36004c68cfa5bfa9c85c_amd64",
                  "product_id": "openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:0b76c21c61cd49eefa986cdbe465ee64cb4e872828ad36004c68cfa5bfa9c85c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topology-aware-lifecycle-manager-rhel8-operator@sha256:0b76c21c61cd49eefa986cdbe465ee64cb4e872828ad36004c68cfa5bfa9c85c?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel8-operator\u0026tag=v4.12.6-11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:b59d0ec9780035bdcd99ce665a772d44ef80bef80a01b7e93af032993db0612b_amd64",
                "product": {
                  "name": "openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:b59d0ec9780035bdcd99ce665a772d44ef80bef80a01b7e93af032993db0612b_amd64",
                  "product_id": "openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:b59d0ec9780035bdcd99ce665a772d44ef80bef80a01b7e93af032993db0612b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topology-aware-lifecycle-manager-precache-rhel8@sha256:b59d0ec9780035bdcd99ce665a772d44ef80bef80a01b7e93af032993db0612b?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel8\u0026tag=v4.12.6-10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:9ad40d51d639ea088071128765959c905fd37ab888a5160db68b3f1f508902cb_amd64",
                "product": {
                  "name": "openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:9ad40d51d639ea088071128765959c905fd37ab888a5160db68b3f1f508902cb_amd64",
                  "product_id": "openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:9ad40d51d639ea088071128765959c905fd37ab888a5160db68b3f1f508902cb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topology-aware-lifecycle-manager-recovery-rhel8@sha256:9ad40d51d639ea088071128765959c905fd37ab888a5160db68b3f1f508902cb?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel8\u0026tag=v4.12.6-10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift4/ztp-site-generate-rhel8@sha256:bb8ee87c7570a4e43fe2fa81f87b4ffa927ecd7156a22cdbae3405563a918c1d_amd64",
                "product": {
                  "name": "openshift4/ztp-site-generate-rhel8@sha256:bb8ee87c7570a4e43fe2fa81f87b4ffa927ecd7156a22cdbae3405563a918c1d_amd64",
                  "product_id": "openshift4/ztp-site-generate-rhel8@sha256:bb8ee87c7570a4e43fe2fa81f87b4ffa927ecd7156a22cdbae3405563a918c1d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ztp-site-generate-rhel8@sha256:bb8ee87c7570a4e43fe2fa81f87b4ffa927ecd7156a22cdbae3405563a918c1d?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ztp-site-generate-rhel8\u0026tag=v4.12.5-9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/bare-metal-event-relay-operator-bundle@sha256:e3035e443ad6c4f0364d175cf2284410cc5a2c1a5b39b6522912330c3114d6c3_amd64 as a component of Red Hat OpenShift Container Platform 4.12",
          "product_id": "8Base-RHOSE-4.12:openshift4/bare-metal-event-relay-operator-bundle@sha256:e3035e443ad6c4f0364d175cf2284410cc5a2c1a5b39b6522912330c3114d6c3_amd64"
        },
        "product_reference": "openshift4/bare-metal-event-relay-operator-bundle@sha256:e3035e443ad6c4f0364d175cf2284410cc5a2c1a5b39b6522912330c3114d6c3_amd64",
        "relates_to_product_reference": "8Base-RHOSE-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/bare-metal-event-relay-rhel8-operator@sha256:c1110b108e61aef37635ec53ef168fb469e13bfbc080f9b12a698913c5b9c036_amd64 as a component of Red Hat OpenShift Container Platform 4.12",
          "product_id": "8Base-RHOSE-4.12:openshift4/bare-metal-event-relay-rhel8-operator@sha256:c1110b108e61aef37635ec53ef168fb469e13bfbc080f9b12a698913c5b9c036_amd64"
        },
        "product_reference": "openshift4/bare-metal-event-relay-rhel8-operator@sha256:c1110b108e61aef37635ec53ef168fb469e13bfbc080f9b12a698913c5b9c036_amd64",
        "relates_to_product_reference": "8Base-RHOSE-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/baremetal-hardware-event-proxy-rhel8@sha256:96503726fa4030b2e8cc78b3216c9803d8fbd954e2b13eaed1bca5e58b5ada49_amd64 as a component of Red Hat OpenShift Container Platform 4.12",
          "product_id": "8Base-RHOSE-4.12:openshift4/baremetal-hardware-event-proxy-rhel8@sha256:96503726fa4030b2e8cc78b3216c9803d8fbd954e2b13eaed1bca5e58b5ada49_amd64"
        },
        "product_reference": "openshift4/baremetal-hardware-event-proxy-rhel8@sha256:96503726fa4030b2e8cc78b3216c9803d8fbd954e2b13eaed1bca5e58b5ada49_amd64",
        "relates_to_product_reference": "8Base-RHOSE-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:f8a6eae2d319c8f55c44b194d8f1bbed97a5e85fd23d6ad829719399f5fce9fb_amd64 as a component of Red Hat OpenShift Container Platform 4.12",
          "product_id": "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:f8a6eae2d319c8f55c44b194d8f1bbed97a5e85fd23d6ad829719399f5fce9fb_amd64"
        },
        "product_reference": "openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:f8a6eae2d319c8f55c44b194d8f1bbed97a5e85fd23d6ad829719399f5fce9fb_amd64",
        "relates_to_product_reference": "8Base-RHOSE-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:b59d0ec9780035bdcd99ce665a772d44ef80bef80a01b7e93af032993db0612b_amd64 as a component of Red Hat OpenShift Container Platform 4.12",
          "product_id": "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:b59d0ec9780035bdcd99ce665a772d44ef80bef80a01b7e93af032993db0612b_amd64"
        },
        "product_reference": "openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:b59d0ec9780035bdcd99ce665a772d44ef80bef80a01b7e93af032993db0612b_amd64",
        "relates_to_product_reference": "8Base-RHOSE-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:9ad40d51d639ea088071128765959c905fd37ab888a5160db68b3f1f508902cb_amd64 as a component of Red Hat OpenShift Container Platform 4.12",
          "product_id": "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:9ad40d51d639ea088071128765959c905fd37ab888a5160db68b3f1f508902cb_amd64"
        },
        "product_reference": "openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:9ad40d51d639ea088071128765959c905fd37ab888a5160db68b3f1f508902cb_amd64",
        "relates_to_product_reference": "8Base-RHOSE-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:0b76c21c61cd49eefa986cdbe465ee64cb4e872828ad36004c68cfa5bfa9c85c_amd64 as a component of Red Hat OpenShift Container Platform 4.12",
          "product_id": "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:0b76c21c61cd49eefa986cdbe465ee64cb4e872828ad36004c68cfa5bfa9c85c_amd64"
        },
        "product_reference": "openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:0b76c21c61cd49eefa986cdbe465ee64cb4e872828ad36004c68cfa5bfa9c85c_amd64",
        "relates_to_product_reference": "8Base-RHOSE-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ztp-site-generate-rhel8@sha256:bb8ee87c7570a4e43fe2fa81f87b4ffa927ecd7156a22cdbae3405563a918c1d_amd64 as a component of Red Hat OpenShift Container Platform 4.12",
          "product_id": "8Base-RHOSE-4.12:openshift4/ztp-site-generate-rhel8@sha256:bb8ee87c7570a4e43fe2fa81f87b4ffa927ecd7156a22cdbae3405563a918c1d_amd64"
        },
        "product_reference": "openshift4/ztp-site-generate-rhel8@sha256:bb8ee87c7570a4e43fe2fa81f87b4ffa927ecd7156a22cdbae3405563a918c1d_amd64",
        "relates_to_product_reference": "8Base-RHOSE-4.12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-37788",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2224245"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in goproxy, which is vulnerable to a denial of service caused by improper input validation. This flaw allows a remote attacker can cause the goproxy server to crash by sending a specially crafted HTTP request to the HTTPS page, replacing the path \"/\" with an asterisk \"*\".",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "goproxy: Denial of service (DoS) via unspecified vectors.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Goproxy is only susceptible to this vulnerability when used in MITM (Man In The Middle) mode. This use case is not relevant to any Red Hat products, so the impact is rated as Moderate.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.12:openshift4/bare-metal-event-relay-operator-bundle@sha256:e3035e443ad6c4f0364d175cf2284410cc5a2c1a5b39b6522912330c3114d6c3_amd64",
          "8Base-RHOSE-4.12:openshift4/bare-metal-event-relay-rhel8-operator@sha256:c1110b108e61aef37635ec53ef168fb469e13bfbc080f9b12a698913c5b9c036_amd64",
          "8Base-RHOSE-4.12:openshift4/baremetal-hardware-event-proxy-rhel8@sha256:96503726fa4030b2e8cc78b3216c9803d8fbd954e2b13eaed1bca5e58b5ada49_amd64",
          "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:f8a6eae2d319c8f55c44b194d8f1bbed97a5e85fd23d6ad829719399f5fce9fb_amd64",
          "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:b59d0ec9780035bdcd99ce665a772d44ef80bef80a01b7e93af032993db0612b_amd64",
          "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:9ad40d51d639ea088071128765959c905fd37ab888a5160db68b3f1f508902cb_amd64",
          "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:0b76c21c61cd49eefa986cdbe465ee64cb4e872828ad36004c68cfa5bfa9c85c_amd64",
          "8Base-RHOSE-4.12:openshift4/ztp-site-generate-rhel8@sha256:bb8ee87c7570a4e43fe2fa81f87b4ffa927ecd7156a22cdbae3405563a918c1d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-37788"
        },
        {
          "category": "external",
          "summary": "RHBZ#2224245",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224245"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-37788",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37788"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-37788",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37788"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-4r8x-2p26-976p",
          "url": "https://github.com/advisories/GHSA-4r8x-2p26-976p"
        },
        {
          "category": "external",
          "summary": "https://github.com/elazarl/goproxy/issues/502",
          "url": "https://github.com/elazarl/goproxy/issues/502"
        },
        {
          "category": "external",
          "summary": "https://github.com/elazarl/goproxy/pull/507",
          "url": "https://github.com/elazarl/goproxy/pull/507"
        }
      ],
      "release_date": "2023-07-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-10-04T14:36:39+00:00",
          "details": "For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html\n\nDetails on how to access this content are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html.",
          "product_ids": [
            "8Base-RHOSE-4.12:openshift4/bare-metal-event-relay-operator-bundle@sha256:e3035e443ad6c4f0364d175cf2284410cc5a2c1a5b39b6522912330c3114d6c3_amd64",
            "8Base-RHOSE-4.12:openshift4/bare-metal-event-relay-rhel8-operator@sha256:c1110b108e61aef37635ec53ef168fb469e13bfbc080f9b12a698913c5b9c036_amd64",
            "8Base-RHOSE-4.12:openshift4/baremetal-hardware-event-proxy-rhel8@sha256:96503726fa4030b2e8cc78b3216c9803d8fbd954e2b13eaed1bca5e58b5ada49_amd64",
            "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:f8a6eae2d319c8f55c44b194d8f1bbed97a5e85fd23d6ad829719399f5fce9fb_amd64",
            "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:b59d0ec9780035bdcd99ce665a772d44ef80bef80a01b7e93af032993db0612b_amd64",
            "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:9ad40d51d639ea088071128765959c905fd37ab888a5160db68b3f1f508902cb_amd64",
            "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:0b76c21c61cd49eefa986cdbe465ee64cb4e872828ad36004c68cfa5bfa9c85c_amd64",
            "8Base-RHOSE-4.12:openshift4/ztp-site-generate-rhel8@sha256:bb8ee87c7570a4e43fe2fa81f87b4ffa927ecd7156a22cdbae3405563a918c1d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHEA-2023:5445"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.12:openshift4/bare-metal-event-relay-operator-bundle@sha256:e3035e443ad6c4f0364d175cf2284410cc5a2c1a5b39b6522912330c3114d6c3_amd64",
            "8Base-RHOSE-4.12:openshift4/bare-metal-event-relay-rhel8-operator@sha256:c1110b108e61aef37635ec53ef168fb469e13bfbc080f9b12a698913c5b9c036_amd64",
            "8Base-RHOSE-4.12:openshift4/baremetal-hardware-event-proxy-rhel8@sha256:96503726fa4030b2e8cc78b3216c9803d8fbd954e2b13eaed1bca5e58b5ada49_amd64",
            "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:f8a6eae2d319c8f55c44b194d8f1bbed97a5e85fd23d6ad829719399f5fce9fb_amd64",
            "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:b59d0ec9780035bdcd99ce665a772d44ef80bef80a01b7e93af032993db0612b_amd64",
            "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:9ad40d51d639ea088071128765959c905fd37ab888a5160db68b3f1f508902cb_amd64",
            "8Base-RHOSE-4.12:openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:0b76c21c61cd49eefa986cdbe465ee64cb4e872828ad36004c68cfa5bfa9c85c_amd64",
            "8Base-RHOSE-4.12:openshift4/ztp-site-generate-rhel8@sha256:bb8ee87c7570a4e43fe2fa81f87b4ffa927ecd7156a22cdbae3405563a918c1d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "goproxy: Denial of service (DoS) via unspecified vectors."
    }
  ]
}

CVE-2023-37788 (GCVE-0-2023-37788)

Vulnerability from cvelistv5 – Published: 2023-07-18 00:00 – Updated: 2024-10-28 15:39

Summary

goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.

Severity

No CVSS data available.

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-28 15:39 UTC

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2279 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/elazarl/goproxy
https://github.com/elazarl/goproxy/issues/502

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:23:27.482Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/elazarl/goproxy"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/elazarl/goproxy/issues/502"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-37788",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-28T15:39:45.820850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-28T15:39:57.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-18T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/elazarl/goproxy"
        },
        {
          "url": "https://github.com/elazarl/goproxy/issues/502"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-37788",
    "datePublished": "2023-07-18T00:00:00.000Z",
    "dateReserved": "2023-07-10T00:00:00.000Z",
    "dateUpdated": "2024-10-28T15:39:57.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted