VDB
RHSA-2023%3A6296
RHSA-2023%3A6296
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in Golang, where it is vulnerable to HTTP header injection caused by improper content validation of the Host header by the HTTP/1 client. A remote attacker can inject arbitrary HTTP headers by persuading a victim to visit a specially crafted Web page. This flaw allows the attacker to conduct various attacks against the vulnerable system, including Cross-site scripting, cache poisoning, or session hijacking.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-serverless-1/serving-storage-version-migration-rhel8@sha256:c42257339c56ecf19990e9639c56c7179890b5b3d1937c1647fefccac657f903_s390x as a component of Red Hat OpenShift Serverless 1.30 | *, openshift-serverless-1/serving-storage-version-migration-rhel8@sha256:c42257339c56ecf19990e9639c56c7179890b5b3d1937c1647fefccac657f903_s390x, openshift-serverless-1/serving-storage-version-migration-rhel8@sha256:c42257339c56ecf19990e9639c56c7179890b5b3d1937c1647fefccac657f903_s390x |
| Red Hat | openshift-serverless-1/kn-cli-artifacts-rhel8@sha256:1c31130fa638c0bf8294cda7d4029f3a4a8b6489c243f0ff245cdd1e976b182c_amd64 as a component of Red Hat OpenShift Serverless 1.30 | openshift-serverless-1/kn-cli-artifacts-rhel8@sha256:1c31130fa638c0bf8294cda7d4029f3a4a8b6489c243f0ff245cdd1e976b182c_amd64, openshift-serverless-1/kn-cli-artifacts-rhel8@sha256:1c31130fa638c0bf8294cda7d4029f3a4a8b6489c243f0ff245cdd1e976b182c_amd64, openshift-serverless-1/kn-cli-artifacts-rhel8@sha256:1c31130fa638c0bf8294cda7d4029f3a4a8b6489c243f0ff245cdd1e976b182c_amd64 |
| Red Hat | openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:fe0033a3c0328aae5a30913490c67c7e4d1643fb6fdbfdc29d8dfa699ce0bb06_s390x as a component of Red Hat OpenShift Serverless 1.30 | openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:fe0033a3c0328aae5a30913490c67c7e4d1643fb6fdbfdc29d8dfa699ce0bb06_s390x, openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:fe0033a3c0328aae5a30913490c67c7e4d1643fb6fdbfdc29d8dfa699ce0bb06_s390x, openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:fe0033a3c0328aae5a30913490c67c7e4d1643fb6fdbfdc29d8dfa699ce0bb06_s390x |
| Red Hat | openshift-serverless-1/eventing-controller-rhel8@sha256:dbbfef23c109add5e192b2930941c156d0a6d2334650f144975e2d1031f8bcdf_s390x as a component of Red Hat OpenShift Serverless 1.30 | *, openshift-serverless-1/eventing-controller-rhel8@sha256:dbbfef23c109add5e192b2930941c156d0a6d2334650f144975e2d1031f8bcdf_s390x, openshift-serverless-1/eventing-controller-rhel8@sha256:dbbfef23c109add5e192b2930941c156d0a6d2334650f144975e2d1031f8bcdf_s390x |
| Red Hat | openshift-serverless-1/eventing-kafka-broker-post-install-rhel8@sha256:dde479e0255b31c862c73ac7aa8faa7842c279e1be7519c207211fa8331ed4f9_s390x as a component of Red Hat OpenShift Serverless 1.30 | openshift-serverless-1/eventing-kafka-broker-post-install-rhel8@sha256:dde479e0255b31c862c73ac7aa8faa7842c279e1be7519c207211fa8331ed4f9_s390x, openshift-serverless-1/eventing-kafka-broker-post-install-rhel8@sha256:dde479e0255b31c862c73ac7aa8faa7842c279e1be7519c207211fa8331ed4f9_s390x, openshift-serverless-1/eventing-kafka-broker-post-install-rhel8@sha256:dde479e0255b31c862c73ac7aa8faa7842c279e1be7519c207211fa8331ed4f9_s390x |
| Red Hat | openshift-serverless-1/eventing-kafka-broker-controller-rhel8@sha256:3ea33587afb65d36532542f985618432cf652894738b5844830478c06a167fcc_amd64 as a component of Red Hat OpenShift Serverless 1.30 | openshift-serverless-1/eventing-kafka-broker-controller-rhel8@sha256:3ea33587afb65d36532542f985618432cf652894738b5844830478c06a167fcc_amd64, openshift-serverless-1/eventing-kafka-broker-controller-rhel8@sha256:3ea33587afb65d36532542f985618432cf652894738b5844830478c06a167fcc_amd64, openshift-serverless-1/eventing-kafka-broker-controller-rhel8@sha256:3ea33587afb65d36532542f985618432cf652894738b5844830478c06a167fcc_amd64 |
| Red Hat | openshift-serverless-1/eventing-mtbroker-ingress-rhel8@sha256:56a6f4dce87527c45581c82b4e0cf573528d667fcde6a64a25bea3297bcba7b5_ppc64le as a component of Red Hat OpenShift Serverless 1.30 | openshift-serverless-1/eventing-mtbroker-ingress-rhel8@sha256:56a6f4dce87527c45581c82b4e0cf573528d667fcde6a64a25bea3297bcba7b5_ppc64le, openshift-serverless-1/eventing-mtbroker-ingress-rhel8@sha256:56a6f4dce87527c45581c82b4e0cf573528d667fcde6a64a25bea3297bcba7b5_ppc64le, * |
| Red Hat | openshift-serverless-1/eventing-webhook-rhel8@sha256:3e0afc59de7e91c6266657f6d9ce1de8405d56ab171a005a1e09159ce162b0d3_s390x as a component of Red Hat OpenShift Serverless 1.30 | *, *, openshift-serverless-1/eventing-webhook-rhel8@sha256:3e0afc59de7e91c6266657f6d9ce1de8405d56ab171a005a1e09159ce162b0d3_s390x |
| Red Hat | openshift-serverless-1/eventing-kafka-broker-controller-rhel8@sha256:c7858bd50cbf967e498e1b79a55f458688c6fd1f4cd55139ff047a750ed0530c_ppc64le as a component of Red Hat OpenShift Serverless 1.30 | openshift-serverless-1/eventing-kafka-broker-controller-rhel8@sha256:c7858bd50cbf967e498e1b79a55f458688c6fd1f4cd55139ff047a750ed0530c_ppc64le, openshift-serverless-1/eventing-kafka-broker-controller-rhel8@sha256:c7858bd50cbf967e498e1b79a55f458688c6fd1f4cd55139ff047a750ed0530c_ppc64le, * |
| Red Hat | openshift-serverless-1/serving-autoscaler-rhel8@sha256:81ec2edba91eba8bebd74ac7066cc12eb60da95289f88860e8b4549ccdf9ac8a_s390x as a component of Red Hat OpenShift Serverless 1.30 | *, openshift-serverless-1/serving-autoscaler-rhel8@sha256:81ec2edba91eba8bebd74ac7066cc12eb60da95289f88860e8b4549ccdf9ac8a_s390x, openshift-serverless-1/serving-autoscaler-rhel8@sha256:81ec2edba91eba8bebd74ac7066cc12eb60da95289f88860e8b4549ccdf9ac8a_s390x |
| Red Hat | openshift-serverless-1/func-utils-rhel8@sha256:537ac0e39cd5898ba65b741707fb6e5981b42a426e970f35222fe166c45f6425_ppc64le as a component of Red Hat OpenShift Serverless 1.30 | *, *, * |
| Red Hat | openshift-serverless-1/serving-controller-rhel8@sha256:10eb6138e2e906ad8edcb691eb27b4b7caa9cfb33c8391bc2478b1a3c1e3a17f_ppc64le as a component of Red Hat OpenShift Serverless 1.30 | openshift-serverless-1/serving-controller-rhel8@sha256:10eb6138e2e906ad8edcb691eb27b4b7caa9cfb33c8391bc2478b1a3c1e3a17f_ppc64le, openshift-serverless-1/serving-controller-rhel8@sha256:10eb6138e2e906ad8edcb691eb27b4b7caa9cfb33c8391bc2478b1a3c1e3a17f_ppc64le, openshift-serverless-1/serving-controller-rhel8@sha256:10eb6138e2e906ad8edcb691eb27b4b7caa9cfb33c8391bc2478b1a3c1e3a17f_ppc64le |
| Red Hat | openshift-serverless-1/eventing-mtchannel-broker-rhel8@sha256:b9b0edd6a1808d025900a616552cad7d656783f37d80e83acbaab18b938e0db3_amd64 as a component of Red Hat OpenShift Serverless 1.30 | *, openshift-serverless-1/eventing-mtchannel-broker-rhel8@sha256:b9b0edd6a1808d025900a616552cad7d656783f37d80e83acbaab18b938e0db3_amd64, openshift-serverless-1/eventing-mtchannel-broker-rhel8@sha256:b9b0edd6a1808d025900a616552cad7d656783f37d80e83acbaab18b938e0db3_amd64 |
| Red Hat | openshift-serverless-1/knative-rhel8-operator@sha256:ed3107ee9d67c218ba2ad65a877356dabbc6775302b542a1db2ebfed6be60bee_ppc64le as a component of Red Hat OpenShift Serverless 1.30 | openshift-serverless-1/knative-rhel8-operator@sha256:ed3107ee9d67c218ba2ad65a877356dabbc6775302b542a1db2ebfed6be60bee_ppc64le, *, openshift-serverless-1/knative-rhel8-operator@sha256:ed3107ee9d67c218ba2ad65a877356dabbc6775302b542a1db2ebfed6be60bee_ppc64le |
| Red Hat | openshift-serverless-1/eventing-webhook-rhel8@sha256:76b8bac332bd58bfb9765e04d9dcb0338254a61779d2d232ea5898244da359b2_amd64 as a component of Red Hat OpenShift Serverless 1.30 | *, *, * |
| Red Hat | openshift-serverless-1/eventing-kafka-broker-webhook-rhel8@sha256:f9203bdf2f0e22d88722f13aee39f5e57e22de223ff95b1df58454f3322db83f_s390x as a component of Red Hat OpenShift Serverless 1.30 | openshift-serverless-1/eventing-kafka-broker-webhook-rhel8@sha256:f9203bdf2f0e22d88722f13aee39f5e57e22de223ff95b1df58454f3322db83f_s390x, openshift-serverless-1/eventing-kafka-broker-webhook-rhel8@sha256:f9203bdf2f0e22d88722f13aee39f5e57e22de223ff95b1df58454f3322db83f_s390x, openshift-serverless-1/eventing-kafka-broker-webhook-rhel8@sha256:f9203bdf2f0e22d88722f13aee39f5e57e22de223ff95b1df58454f3322db83f_s390x |
| Red Hat | openshift-serverless-1/serving-domain-mapping-webhook-rhel8@sha256:ef1c7a89eb10e51dfb677fd1a0a4e3475db5220b637b87def4a682d73e261078_s390x as a component of Red Hat OpenShift Serverless 1.30 | *, openshift-serverless-1/serving-domain-mapping-webhook-rhel8@sha256:ef1c7a89eb10e51dfb677fd1a0a4e3475db5220b637b87def4a682d73e261078_s390x, * |
| Red Hat | openshift-serverless-1/eventing-kafka-broker-controller-rhel8@sha256:41207762bc2e8a96d9cc1f40e5be8d0785b92b9df1fae4c947fd5f58d39ce80f_s390x as a component of Red Hat OpenShift Serverless 1.30 | openshift-serverless-1/eventing-kafka-broker-controller-rhel8@sha256:41207762bc2e8a96d9cc1f40e5be8d0785b92b9df1fae4c947fd5f58d39ce80f_s390x, openshift-serverless-1/eventing-kafka-broker-controller-rhel8@sha256:41207762bc2e8a96d9cc1f40e5be8d0785b92b9df1fae4c947fd5f58d39ce80f_s390x, openshift-serverless-1/eventing-kafka-broker-controller-rhel8@sha256:41207762bc2e8a96d9cc1f40e5be8d0785b92b9df1fae4c947fd5f58d39ce80f_s390x |
| Red Hat | openshift-serverless-1/client-kn-rhel8@sha256:d12dc8841593e2c241d2d0239804292760f65517cb5743c24802e62c02d02abf_ppc64le as a component of Red Hat OpenShift Serverless 1.30 | openshift-serverless-1/client-kn-rhel8@sha256:d12dc8841593e2c241d2d0239804292760f65517cb5743c24802e62c02d02abf_ppc64le, openshift-serverless-1/client-kn-rhel8@sha256:d12dc8841593e2c241d2d0239804292760f65517cb5743c24802e62c02d02abf_ppc64le, openshift-serverless-1/client-kn-rhel8@sha256:d12dc8841593e2c241d2d0239804292760f65517cb5743c24802e62c02d02abf_ppc64le |
| Red Hat | openshift-serverless-1/eventing-kafka-broker-post-install-rhel8@sha256:4255a0d699e16b5a4e7e90e3ba5057ccdf259851fa8ade71ce8c2bc50864ec97_amd64 as a component of Red Hat OpenShift Serverless 1.30 | openshift-serverless-1/eventing-kafka-broker-post-install-rhel8@sha256:4255a0d699e16b5a4e7e90e3ba5057ccdf259851fa8ade71ce8c2bc50864ec97_amd64, *, openshift-serverless-1/eventing-kafka-broker-post-install-rhel8@sha256:4255a0d699e16b5a4e7e90e3ba5057ccdf259851fa8ade71ce8c2bc50864ec97_amd64 |
…and 217 more
Timeline
- Nov 2, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 21, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:6296 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1.30 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2222167 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2228743 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2243296 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6296.json advisory
- https://access.redhat.com/security/cve/CVE-2023-29406 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-29406 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-29406 advisory
- https://groups.google.com/g/golang-announce/c/2q13H6LEEx0 advisory
- https://access.redhat.com/security/cve/CVE-2023-29409 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-29409 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-29409 advisory
- https://go.dev/cl/515257 advisory
- https://go.dev/issue/61460 advisory
- https://groups.google.com/g/golang-announce/c/X0b6CsSAaYI/m/Efv5DbZ9AwAJ advisory
- https://pkg.go.dev/vuln/GO-2023-1987 advisory
- https://access.redhat.com/security/cve/CVE-2023-39325 advisory
…and 12 more