Red Hat Security Advisory

RHSA-2022:1734

Migration Toolkit for Containers (MTC) 1.7.1 security and bug fix update

Released 2022-05-05 · Red Hat rating Moderate · View on Red Hat →

Fixed in

8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-velero-rhel8

Fixes 5 records

TI-2021-20237 CVE-2021-44716 · GHSA-vc3p-29h2-gpcp

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory…

MEDIUM 40

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04254 Published 2022-01-01 Partial fix · 0.0.0-20211209124913-491a49abca63 CWE-400

TI-2021-18415 CVE-2021-41771 · GHSA-g56w-5r6h-483w

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x…

MEDIUM 40

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04698 Published 2021-11-08 Partial fix CWE-119

TI-2021-18416 CVE-2021-41772 · GHSA-8rv2-6fw3-rxjg

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a…

LOW 39

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03253 Published 2021-11-08 Partial fix CWE-20

TI-2021-18029 CVE-2021-41190 · GHSA-mc8v-mgrf-8f4m

Clarify Content-Type handling in OCI spec

LOW 27

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.02223 Published 2021-11-17 Partial fix · 1.0.1 CWE-843

TI-2021-20238 CVE-2021-44717 · GHSA-x9r7-cjm2-h6cp

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an…

LOW 26

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustio…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.01997 Published 2022-01-01 Partial fix CWE-404