CVE-2023-29400
medium
CVSS v3
—
CVSS v4 NEW
—
VIR risk
5.5
Description
RHSA-2023:6939: container-tools:rhel8 security and bug fix update (Moderate)
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API
Description golang: html/template: improper handling of empty HTML attributes Red Hat statement For Red Hat Enterprise Linux, * Conmon uses go in unit testing, but not functionally in the package. Go is used only in test files, not in the actual code. Thus, conmon is not affected. * The Go templates in Grafana do not contain any javascript. Thus, it is not affected. * Ignition does not make use…
Description
golang: html/template: improper handling of empty HTML attributes
Red Hat statement
For Red Hat Enterprise Linux, * Conmon uses go in unit testing, but not functionally in the package. Go is used only in test files, not in the actual code. Thus, conmon is not affected. * The Go templates in Grafana do not contain any javascript. Thus, it is not affected. * Ignition does not make use of html/template. In OpenShift Container Platform and Red Hat Advanced Cluster Management for Kubernetes (RHACM), the affected containers are behind OAuth authentication. This restricts access to the vulnerable golang html/templates to authenticated users, reducing the impact to low.
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Errata / fixed releases
| Product | Package | Advisory | Released |
|---|---|---|---|
| CERT-MANAGER-1.10-RHEL-9 | cert-manager-operator-bundle-container-v1.10.3-4 | RHSA-2023:4335 | 2023-08-08T00:00:00Z |
| CERT-MANAGER-1.10-RHEL-9 | cert-manager-operator-container-v1.10.3-2 | RHSA-2023:4335 | 2023-08-08T00:00:00Z |
| CERT-MANAGER-1.10-RHEL-9 | jetstack-cert-manager-container-v1.10.2-18 | RHSA-2023:4335 | 2023-08-08T00:00:00Z |
| Migration Toolkit for Virtualization 2.4 | migration-toolkit-virtualization/mtv-controller-rhel9:2.4.3-5 | RHBA-2023:6109 | 2023-10-25T00:00:00Z |
| MTA-6.2-RHEL-9 | mta/mta-hub-rhel9:6.2.0-16 | RHSA-2023:4627 | 2023-08-14T00:00:00Z |
| NETWORK-OBSERVABILITY-1.3.0-RHEL-9 | network-observability/network-observability-rhel9-operator:v1.3.0-53 | RHSA-2023:3905 | 2023-06-28T00:00:00Z |
| OADP-1.1-RHEL-8 | oadp/oadp-velero-rhel8:1.1.5-3 | RHSA-2023:3918 | 2023-06-29T00:00:00Z |
| OSSO-1.1-RHEL-8 | openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8:v1.1-30 | RHSA-2023:4657 | 2023-08-23T00:00:00Z |
| Red Hat Ansible Automation Platform 2.3 for RHEL 8 | openshift-clients-0:4.12.0-202307200611.p0.g49844f7.assembly.stream.el8 | RHSA-2023:4470 | 2023-08-03T00:00:00Z |
| Red Hat Developer Tools | go-toolset-1.19-golang-0:1.19.9-1.el7_9 | RHSA-2023:3323 | 2023-05-25T00:00:00Z |
| Red Hat Enterprise Linux 8 | go-toolset:rhel8-8080020230517172404.6b4b45d8 | RHSA-2023:3319 | 2023-05-25T00:00:00Z |
| Red Hat Enterprise Linux 8 | container-tools:4.0-8090020230828093056.e7857ab1 | RHSA-2023:6938 | 2023-11-14T00:00:00Z |
| Red Hat Enterprise Linux 8 | container-tools:rhel8-8090020230825121312.e7857ab1 | RHSA-2023:6939 | 2023-11-14T00:00:00Z |
| Red Hat Enterprise Linux 9 | golang-0:1.19.9-2.el9_2 | RHSA-2023:3318 | 2023-05-25T00:00:00Z |
| Red Hat Enterprise Linux 9 | toolbox-0:0.0.99.4-6.el9_3 | RHSA-2023:6346 | 2023-11-07T00:00:00Z |
| Red Hat Enterprise Linux 9 | skopeo-2:1.13.3-1.el9 | RHSA-2023:6363 | 2023-11-07T00:00:00Z |
| Red Hat Enterprise Linux 9 | containernetworking-plugins-1:1.3.0-4.el9 | RHSA-2023:6402 | 2023-11-07T00:00:00Z |
| Red Hat Enterprise Linux 9 | buildah-1:1.31.3-1.el9 | RHSA-2023:6473 | 2023-11-07T00:00:00Z |
| Red Hat Enterprise Linux 9 | podman-2:4.6.1-5.el9 | RHSA-2023:6474 | 2023-11-07T00:00:00Z |
| Red Hat Migration Toolkit for Containers 1.7 | rhmtc/openshift-velero-plugin-rhel8:v1.7.11-3 | RHSA-2023:4293 | 2023-07-27T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/cloud-network-config-controller-rhel8:v4.13.0-202305262054.p0.g71ccef5.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/egress-router-cni-rhel8:v4.13.0-202305270643.p0.g879b72b.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/kubevirt-csi-driver-rhel8:v4.13.0-202305262054.p0.gefa0b94.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/network-tools-rhel8:v4.13.0-202305300541.p0.gb4098c6.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/oc-mirror-plugin-rhel8:v4.13.0-202305262054.p0.g74d3207.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/openshift-route-controller-manager-rhel8:v4.13.0-202305262054.p0.gd7a8e22.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-agent-installer-api-server-rhel8:v4.13.0-202305291355.p0.g8db33db.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-agent-installer-csr-approver-rhel8:v4.13.0-202305291355.p0.g6160d18.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-agent-installer-node-agent-rhel8:v4.13.0-202305262054.p0.ge8de058.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-agent-installer-orchestrator-rhel8:v4.13.0-202305262054.p0.g6160d18.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-alibaba-cloud-controller-manager-rhel8:v4.13.0-202305262054.p0.gb5200ba.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-alibaba-cloud-csi-driver-container-rhel8:v4.13.0-202305262054.p0.g68c0ecf.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8:v4.13.0-202305262054.p0.g0f4b92a.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-alibaba-machine-controllers-rhel8:v4.13.0-202305262054.p0.g4c0f96a.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-apiserver-network-proxy-rhel8:v4.13.0-202305262054.p0.g61e198c.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-aws-cloud-controller-manager-rhel8:v4.13.0-202305262054.p0.g946daa0.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-aws-cluster-api-controllers-rhel8:v4.13.0-202305262054.p0.g4251ed3.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-aws-ebs-csi-driver-rhel8:v4.13.0-202305262054.p0.gd8fa531.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-aws-ebs-csi-driver-rhel8-operator:v4.13.0-202305262054.p0.gb6dee5c.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-aws-pod-identity-webhook-rhel8:v4.13.0-202305262054.p0.g4969655.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-azure-cloud-controller-manager-rhel8:v4.13.0-202305262054.p0.g7afcf26.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-azure-cloud-node-manager-rhel8:v4.13.0-202305262054.p0.g7afcf26.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-azure-cluster-api-controllers-rhel8:v4.13.0-202305262054.p0.g9885d4d.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-azure-disk-csi-driver-rhel8:v4.13.0-202305262054.p0.g202e8af.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-azure-disk-csi-driver-rhel8-operator:v4.13.0-202305262054.p0.g67bda47.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-azure-file-csi-driver-operator-rhel8:v4.13.0-202305262054.p0.g994c32c.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-azure-file-csi-driver-rhel8:v4.13.0-202305262054.p0.gfd94a03.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-baremetal-installer-rhel8:v4.13.0-202305270643.p0.gb332f7a.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-baremetal-machine-controllers:v4.13.0-202305262054.p0.gd20bc57.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-baremetal-rhel8-operator:v4.13.0-202305290832.p0.gb771b3b.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-baremetal-runtimecfg-rhel8:v4.13.0-202305262054.p0.gf0c1297.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cli:v4.13.0-202305291355.p0.g1024efc.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cli-artifacts:v4.13.0-202305291355.p0.g1024efc.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cloud-credential-operator:v4.13.0-202305262054.p0.gd3b5ffa.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cluster-api-rhel8:v4.13.0-202305262054.p0.g0142186.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cluster-authentication-operator:v4.13.0-202305262054.p0.ga69e6b7.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cluster-autoscaler:v4.13.0-202305262054.p0.gc58c53b.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cluster-autoscaler-operator:v4.13.0-202305262054.p0.g99a0e2b.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cluster-baremetal-operator-rhel8:v4.13.0-202305262054.p0.gdb28311.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
| Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cluster-bootstrap:v4.13.0-202305262054.p0.gee908b6.assembly.stream | RHSA-2023:3367 | 2023-06-07T00:00:00Z |
Package state
| Product | Package | State |
|---|---|---|
| Custom Metric Autoscaler operator for Red Hat Openshift | custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8 | Not affected |
| Logging Subsystem for Red Hat OpenShift | openshift-logging/logging-loki-rhel8 | Not affected |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-rhel8-operator | Under investigation |
| OpenShift Developer Tools and Services | helm | Affected |
| OpenShift Developer Tools and Services | odo | Will not fix |
| OpenShift Pipelines | openshift-pipelines-client | Will not fix |
| OpenShift Service Mesh 2 | openshift-golang-builder-container | Not affected |
| Red Hat 3scale API Management Platform 2 | 3scale-operator-container | Affected |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/subctl-rhel9 | Affected |
| Red Hat AMQ Broker 7 | amq-broker-rhel8-operator-container | Affected |
| Red Hat Application Interconnect 1.0 | skupper-cli | Affected |
| Red Hat Ceph Storage 3 | golang | Will not fix |
| Red Hat Ceph Storage 5 | rhceph/rhceph-5-dashboard-rhel8 | Affected |
| Red Hat Enterprise Linux 8 | container-tools:3.0/containernetworking-plugins | Not affected |
| Red Hat Enterprise Linux 8 | container-tools:3.0/skopeo | Not affected |
| Red Hat Enterprise Linux 8 | container-tools:3.0/toolbox | Will not fix |
| Red Hat Enterprise Linux 8 | grafana | Not affected |
| Red Hat Enterprise Linux 8 | grafana-pcp | Not affected |
| Red Hat Enterprise Linux 8 | osbuild-composer | Will not fix |
| Red Hat Enterprise Linux 9 | conmon | Not affected |
| Red Hat Enterprise Linux 9 | grafana | Not affected |
| Red Hat Enterprise Linux 9 | grafana-pcp | Not affected |
| Red Hat Enterprise Linux 9 | ignition | Will not fix |
| Red Hat Enterprise Linux 9 | osbuild-composer | Will not fix |
| Red Hat OpenShift Container Platform 4 | containernetworking-plugins | Not affected |
| Red Hat OpenShift Container Platform 4 | ignition | Not affected |
| Red Hat OpenShift Container Platform 4 | openshift | Not affected |
| Red Hat Openshift Data Foundation 4 | mcg | Affected |
| Red Hat OpenShift Data Science (RHODS) | rhods/odh-mm-rest-proxy-rhel8 | Affected |
| Red Hat OpenShift Dev Spaces | devspaces/udi-rhel8 | Affected |
| Red Hat OpenShift distributed tracing 2 | rhosdt/jaeger-agent-rhel8 | Affected |
| Red Hat OpenShift GitOps | openshift-gitops-1/gitops-rhel8 | Will not fix |
| Red Hat OpenShift GitOps | openshift-gitops-kam | Affected |
| Red Hat Openshift Sandboxed Containers | openshift-sandboxed-containers/osc-rhel9-operator | Under investigation |
| Red Hat OpenShift Virtualization 4 | kubevirt | Affected |
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/osp-director-agent | Not affected |
| Red Hat Quay 3 | quay/clair-rhel8 | Affected |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | Not affected |
| Red Hat Storage 3 | golang | Will not fix |
| Red Hat Storage 3 | go-toolset-7-golang | Will not fix |
| Red Hat Web Terminal | web-terminal-exec-container | Affected |
| Self Node Remediation Operator | workload-availability/self-node-remediation-rhel8-operator | Affected |
Apply commands
Apply RHSA-2023:4335 for CERT-MANAGER-1.10-RHEL-9
yum update -y cert-manager-operator-bundle-container-v1
# or:
dnf upgrade -y cert-manager-operator-bundle-container-v1Affected
| Vendor | Product | Version |
|---|---|---|
| redhat | Custom Metric Autoscaler operator for Red Hat Openshift | Not affected |
| redhat | Logging Subsystem for Red Hat OpenShift | Not affected |
| redhat | OpenShift Developer Tools and Services | Affected |
| redhat | OpenShift Service Mesh 2 | Not affected |
| redhat | Red Hat 3scale API Management Platform 2 | Affected |
| redhat | Red Hat Advanced Cluster Management for Kubernetes 2 | Affected |
| redhat | Red Hat AMQ Broker 7 | Affected |
| redhat | Red Hat Application Interconnect 1.0 | Affected |
| redhat | Red Hat Ceph Storage 5 | Affected |
| redhat | Red Hat Enterprise Linux 8 | Not affected |
| redhat | Red Hat Enterprise Linux 8 | Not affected |
| redhat | Red Hat Enterprise Linux 8 | Not affected |
| redhat | Red Hat Enterprise Linux 8 | Not affected |
| redhat | Red Hat Enterprise Linux 9 | Not affected |
| redhat | Red Hat Enterprise Linux 9 | Not affected |
| redhat | Red Hat Enterprise Linux 9 | Not affected |
| redhat | Red Hat OpenShift Container Platform 4 | Not affected |
| redhat | Red Hat OpenShift Container Platform 4 | Not affected |
| redhat | Red Hat OpenShift Container Platform 4 | Not affected |
| redhat | Red Hat Openshift Data Foundation 4 | Affected |
| redhat | Red Hat OpenShift Data Science (RHODS) | Affected |
| redhat | Red Hat OpenShift Dev Spaces | Affected |
| redhat | Red Hat OpenShift distributed tracing 2 | Affected |
| redhat | Red Hat OpenShift GitOps | Affected |
| redhat | Red Hat OpenShift Virtualization 4 | Affected |
| redhat | Red Hat OpenStack Platform 16.2 | Not affected |
| redhat | Red Hat Quay 3 | Affected |
| redhat | Red Hat Satellite 6 | Not affected |
| redhat | Red Hat Web Terminal | Affected |
| redhat | Self Node Remediation Operator | Affected |
OS impact
Debian Affected 2 releases
| Version | Status | Fixed in |
|---|---|---|
| bullseye | Affected | — |
| bookworm | Affected | — |
SUSE Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Affected | — |
AlmaLinux Fixed 1 release
| Version | Status | Fixed in |
|---|---|---|
| 9 | Fixed | buildah-tests-1.31.3-1.el9.aarch64.rpm |
Red Hat Fixed 2 releases
| Version | Status | Fixed in |
|---|---|---|
| 9 | Fixed | — |
| 8 | Fixed | — |
Rocky Linux Fixed 1 release
| Version | Status | Fixed in |
|---|---|---|
| 8 | Fixed | — |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Go | stdlib | >=1.20.0-0,<1.20.4 | 1.19.9 |
References
- https://errata.rockylinux.org/RLSA-2023:6938
- https://errata.rockylinux.org/RLSA-2023:6939
- https://access.redhat.com/errata/RHSA-2023:3318
- https://access.redhat.com/errata/RHSA-2023:6346
- https://access.redhat.com/errata/RHSA-2023:6363
- https://access.redhat.com/errata/RHSA-2023:6402
- https://access.redhat.com/errata/RHSA-2023:6473
- https://access.redhat.com/errata/RHSA-2023:6474
- https://go.dev/issue/59722
- https://go.dev/cl/491617
- https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
- https://www.suse.com/security/cve/CVE-2023-29400.html
- https://security-tracker.debian.org/tracker/CVE-2023-29400
- https://bugzilla.redhat.com/2174485
- https://bugzilla.redhat.com/2178358
- https://bugzilla.redhat.com/2178488
- https://bugzilla.redhat.com/2178492
- https://bugzilla.redhat.com/2184481
- https://bugzilla.redhat.com/2184482
- https://bugzilla.redhat.com/2184483
- https://bugzilla.redhat.com/2184484
- https://bugzilla.redhat.com/2196026
- https://bugzilla.redhat.com/2196027
- https://bugzilla.redhat.com/2196029
- https://bugzilla.redhat.com/2222167
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.