Red Hat Security AdvisoryRHSA-2022:1476
Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes
Released 2022-04-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
Fixes 12 records
Priority HIGH 77
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.73188 · Published 2022-03-15 · Partial fix · 300.0.5, 111.18.0 CWE-835
Priority HIGH 72
The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02718 · Published 2022-03-25 · Partial fix · 1.1.4 CWE-863
Priority MEDIUM 46
The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the p…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01943 · Published 2022-01-21 · Partial fix · 1.1.0 CWE-1321
Priority MEDIUM 41
NATS nats-server before 2.7.2 has Incorrect Access Control.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0133 · Published 2022-02-08 · Partial fix · 2.7.2, 0.24.1 CWE-862
Priority MEDIUM 40
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03963 · Published 2022-03-18 · Partial fix · 0.0.0-20220314234659-1baeb1ce4c0b CWE-327
Priority LOW 35
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01193 · Published 2022-09-06 · Partial fix · 0.0.0-20211202192323-5770296d904e
Priority LOW 34
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02608 · Published 2022-01-10 · Partial fix · 1.14.7 CWE-359
Priority LOW 32
shelljs is vulnerable to Improper Privilege Management
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.0046 · Published 2022-01-11 · Partial fix · 0.8.5 CWE-269
Priority LOW 31
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01653 · Published 2022-01-16 · Partial fix · 3.1.1, 2.6.7 CWE-200
Priority LOW 29
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01337 · Published 2022-02-09 · Partial fix · 1.14.8 CWE-212
Priority LOW 27
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content.
CVSS 3.1MEDIUM 5.0· Network · Low privileges · No interaction · EPSS 0.02223 · Published 2021-11-17 · Partial fix · 1.0.1 CWE-843
Priority LOW 25
The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00473 · Published 2022-01-14 · Partial fix · 3.1.31 CWE-704
THREATIST.IORead the docs