Maliciously crafted Git server replies can cause DoS on go-git clients
CVE: CVE-2023-49568
Component: go-git
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-12-24T00:00:00+00:00

A denial of service (DoS) vulnerability was found in the go library go-git. This issue may allow an attacker to perform denial of service attacks by providing specially crafted responses from a Git server, which can trigger resource exhaustion in go-git clients.

Statement: This problem only affects the go implementation and not the original git cli code. Applications using only in-memory filesystems are not affected by this issue. Clients should be limited to connect to only trusted git servers to reduce the risk of compromise.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
See the Red Hat OpenShift serverless documentation at: 
https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1.31
For Red Hat Advanced Cluster Management for Kubernetes, see the following
documentation, which will be updated shortly for this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html-single/install/index#installing
If you are using an earlier version of RHACS, you are advised to upgrade to release 4.4.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:7446b0c3cc24c6d35c0d0fc968ef27f52da92c60f41951c0e646041db108169a

      (For s390x architecture)
      The image digest is sha256:0297188ad2936833b6b1377ca35276277d86fd614dfed8209fb1c06ccea4087d

      (For ppc64le architecture)
      The image digest is sha256:7c6bca201a245b790a2d122fb0e0717db2c9c95a2aa505e2db6fa3b16218e00b

      (For aarch64 architecture)
      The image digest is sha256:c8e7b64a4fa1145eeac395b4895fb60524f71f22eaffee0f69fd70e25b3bab16

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are:

(For x86_64 architecture)
The image digest is sha256:158ced797e49f6caf7862acccef58484be63b642fdd2f66e6416295fa7958ab0

(For s390x architecture)
The image digest is sha256:0dc967d680e06ba58c2e30f3729fd4dd0274603b1e5e717172bb06ba1977aa9e

(For ppc64le architecture)
The image digest is sha256:485e2734d2f926af79f555c24fd622dd2c9765e830e088a1b843c2534dedbce8

(For aarch64 architecture)
The image digest is sha256:84ee8f7f61a0b2ee67e83e98ed48ad6e2584253fba44047716d042a8a90ff4c2

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:a9d7e4938d224a6a8f9c7a5c05ca2b4d6e92292812b14c4a3e0d9e938e8dc3bf

      (For s390x architecture)
      The image digest is sha256:d2b27993318e4e72388bcc8a4ba655810e903f0e6bdcb444648e8d0488646816

      (For ppc64le architecture)
      The image digest is sha256:9d42788d7b8ad829c43ff536471b7245745ed86d6285f39a5c8050541bc52b85

      (For aarch64 architecture)
      The image digest is sha256:192059898431ff5af6b60d4e1f583ef32b4c59b08772a9f73c1735a812700f6b

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:dbb8aa0cf53dc5ac663514e259ad2768d8c82fd1fe7181a4cfb484e3ffdbd3ba

      (For s390x architecture)
      The image digest is sha256:421f1d408713576cd597aeabdeefb2cad6c6d4c1f40e0a88e9026911fb69aaaf

      (For ppc64le architecture)
      The image digest is sha256:00283cbb7dceb54be3bea4f7d2b7877eac7dadcd952f0e4b0c3d95cf761f03bb

      (For aarch64 architecture)
      The image digest is sha256:b6395664a18f7fe6ae8faf57a6be0490ffffa12b71dfa42e9515f91baa407a6f

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:7083519fd75dc187b7405968ba3d3d764a9807529e955411fd0ca1142dd4b560
      (For s390x architecture)
      The image digest is sha256:fd12ce4b8e006c6d8613f32f36e5ca994aeef6dee158b7179c450af2b86de4b9

      (For ppc64le architecture)
      The image digest is sha256:d46a10358eb60f80a0d483aeba8c28d834769465a298ecb37dc69c7ab4cd92d9

      (For aarch64 architecture)
      The image digest is sha256:2e6962da6066332442fbd5d27b5917f3980bef59be6cabab263774ac615213db

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags

The sha values for the release are:

(For x86_64 architecture)
The image digest is sha256:04081f0cdc3a98eb9b705aceb86d4a035f7e6ccf6d9d10621776d53134f81c33

(For s390x architecture)
The image digest is sha256:ca025a3ba9de59089b7278263115bd54a4d7164e48b9fa856c6f3688f62dae82

(For ppc64le architecture)
The image digest is sha256:f42073e4296bd8e8dcf1b3ccf3a9a0213eac6039a1393d56bd34514606e09900

(For aarch64 architecture)
The image digest is sha256:64a6652bc3ee1eeaa4020ec7ea73e7484b398aa98144bcc4774cbb1358375027

All OpenShift Container Platform 4.13 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift Console
or the CLI oc command. Instructions for upgrading a cluster are available
at
https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:7093fa606debe63820671cc92a1384e14d0b70058d4b4719d666571e1fc62190

      (For s390x architecture)
      The image digest is sha256:784621b67af470153f02521237b8170fed3d58d31333b4b094cf30f6d657e40e

      (For ppc64le architecture)
      The image digest is sha256:6cedfcf05100b51d7dab8ac4c0ea8c06aac8989143a3d564daf5b8041120e3ae

      (For aarch64 architecture)
      The image digest is sha256:7c13402788d2e98964fa6e53b435b02b62d71769ce6c66fb4cf7d0116c7a33c6

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:36783a8b066c96dd6258e818ce51b5a763438adbf56221ea5c4b62ae4f345886

      (For s390x architecture)
      The image digest is sha256:ae44573838e7a212a5c1c770249862763cacc3dcc07cedca37a140a73ee8ab01

      (For ppc64le architecture)
      The image digest is sha256:6dc606eb76237e5fca46cf0ecc5665c473571b58c73b3e2ae48cda4f7eb62748

      (For aarch64 architecture)
      The image digest is sha256:a456939baf9762ce465d90a73aee8b1dc73c79321472aefb88496766eba5add7

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:671bc35e8fc2027d6f4c2c756d19909d83d55d1c591e8f9ea790ec8da744d171

      (For s390x architecture)
      The image digest is sha256:641ac9df3fbc2575922e68cc2e3b0903d7d268faf6862777fca93ac7ed2fe82b

      (For ppc64le architecture)
      The image digest is sha256:ab24f08a86cb6715e3259153ab44820620d80f21c87781001289bc7ebe13cf02

      (For aarch64 architecture)
      The image digest is sha256:7f3942d330660112a9220786bd2fb3015f05bda0354002f70cf5735e6386b93b

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:e4424eeec8a386241a5348d556bdd6dd82ea68f4f19f30f71d18963fb5924e9e

      (For s390x architecture)
      The image digest is sha256:18f2061d6755cfe769b710dc6123cdb0e3dd35d0fbbe768f8a0a4dcdbe6f112c

      (For ppc64le architecture)
      The image digest is sha256:806422d328acfd09684dab98482fb60bb3e4d224927a13d9e12a71226e122e5c

      (For aarch64 architecture)
      The image digest is sha256:fd2c3b924ed5e03ff6f38f86a8d91e220a30c19f685ade0f3adc739f5b94ef89

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:0f55261077557d1bb909c06b115e0c79b0025677be57ba2f045495c11e2443ee

      (For s390x architecture)
      The image digest is sha256:51333a191236aa122045b0016a35a3501605e544f561015568cd58b4a1b93260

      (For ppc64le architecture)
      The image digest is sha256:db6e7bae8b5ee4d9b39ab13932b55ea861d5e2c5d17a17ad730deb4224ab3296

      (For aarch64 architecture)
      The image digest is sha256:bea5c0d194d622934cc7dee330b66cf49f5be3f4ae98e07c1cb6c8fd102ee42f

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
See the Red Hat OpenShift serverless 1.31 documentation at: 
https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1.31
See the multicluster global hub product documentation for more information:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html-single/multicluster_global_hub/index
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:7111fb4cec202cb758f58d9bed95a67e7fdc417353ef15be56d7bf96356909d4

      (For s390x architecture)
      The image digest is sha256:3dd4771c36e66984070fce29d4498d4047f4d54aaf2763758f5fb077c7e1348c

      (For ppc64le architecture)
      The image digest is sha256:87856c84d81c70fb57151720cff19f90ef7c44c9c36005c8c7e8739f772dc4be

      (For aarch64 architecture)
      The image digest is sha256:ef5e1f9b9cbe3ac42323a6aab66ee436fe12adf1c0623d17213d0fbfe45c2ba8

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.