RHSA-2023:0803: Important: Red Hat OpenShift GitOps security update
Security Fix(es): goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be (CVE-2021-4238) go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064) ArgoCD: Users with any cluster secret update access may update out-of-bounds cluster secrets (CVE-2023-23947) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:0803?
The severity of RHSA-2023:0803 is critical due to vulnerabilities affecting randomness and performance in affected software components.
How do I fix RHSA-2023:0803?
To fix RHSA-2023:0803, update your software to the latest versions provided in the advisory.
What are the vulnerabilities addressed in RHSA-2023:0803?
RHSA-2023:0803 addresses vulnerabilities in goutils and go-yaml related to randomness and parsing that could lead to security risks.
Which software is affected by RHSA-2023:0803?
RHSA-2023:0803 affects components such as goutils and go-yaml that are used in various applications.
What should I be aware of regarding the CVEs in RHSA-2023:0803?
You should be aware that CVE-2021-4238 and CVE-2022-3064 can lead to potential exploitation if not mitigated by updating affected software.