Red Hat Security Advisory

RHSA-2022:0434

Release of OpenShift Serverless 1.20.0

Released 2022-02-03 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Serverless 1.20 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +31

Fixes 3 records

TI-2021-15910 CVE-2021-38297 · GHSA-xv38-944c-p763

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a…

MEDIUM 55

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10962 Published 2021-10-18 Partial fix CWE-120

TI-2021-16667 CVE-2021-39293 · GHSA-j532-8pqq-78jr

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header…

MEDIUM 43

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06934 Published 2022-01-24 Partial fix CWE-770

TI-2021-10545 CVE-2021-29923 · GHSA-38h6-vxp4-qxvm

Go before 1.17 does not properly consider extraneous zero characters at the beginning of…

LOW 39

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03744 Published 2021-08-07 Partial fix