Red Hat Security Advisory

RHSA-2022:0056

OpenShift Container Platform 4.10.3 security update

Released 2022-03-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.10 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47

Fixes 8 records

TI-2021-16611 CVE-2021-39226 · GHSA-69j6-29vr-p3j9

Snapshot authentication bypass in grafana

CRITICAL 100KEV

Grafana is an open source data visualization platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99933 Published 2021-10-05 Partial fix · 8.1.6, 7.5.11 CWE-287

TI-2021-19619 CVE-2021-43813

Directory Traversal in Grafana

MEDIUM 53

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.56588 Published 2021-12-10 Partial fix · 7.5.12, 8.3.2 CWE-22

TI-2021-02682 CVE-2021-3749 · GHSA-cph5-m8f7-6c5x

Inefficient Regular Expression Complexity in axios/axios

MEDIUM 44

axios is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08515 Published 2021-08-31 Partial fix · 0.21.2 CWE-1333

TI-2021-02215 CVE-2021-3121 · GHSA-c3h9-896r-86jm

An issue was discovered in GoGo Protobuf before 1.3.2.

MEDIUM 43

An issue was discovered in GoGo Protobuf before 1.3.2.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.03425 Published 2021-01-11 Partial fix · 1.3.2 CWE-129

TI-2021-20237 CVE-2021-44716 · GHSA-vc3p-29h2-gpcp

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory…

MEDIUM 40

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04254 Published 2022-01-01 Partial fix · 0.0.0-20211209124913-491a49abca63 CWE-400

TI-2021-18416 CVE-2021-41772 · GHSA-8rv2-6fw3-rxjg

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a…

LOW 39

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03253 Published 2021-11-08 Partial fix CWE-20

TI-2021-20238 CVE-2021-44717 · GHSA-x9r7-cjm2-h6cp

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an…

LOW 26

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustio…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.01997 Published 2022-01-01 Partial fix CWE-404

TI-2022-06050 CVE-2022-21673

OAuth Identity Token exposure in Grafana

LOW 24

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01996 Published 2022-01-18 Partial fix · 7.5.13, 8.3.4 CWE-200