Red Hat Security Advisory

RHSA-2022:4668

OpenShift Virtualization 4.10.1 Images security and bug fix update

Released 2022-05-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

CNV 4.10 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8

Fixes 3 records

TI-2022-06074 CVE-2022-21698 · GHSA-cg3q-j54f-5p7p

Uncontrolled Resource Consumption in promhttp

MEDIUM 48

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05994 Published 2022-02-15 Partial fix · 1.11.1 CWE-400

TI-2021-14632 CVE-2021-36221 · GHSA-6qcx-qr4g-4fx9

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a…

LOW 32

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.03114 Published 2021-08-08 Partial fix CWE-362

TI-2021-18029 CVE-2021-41190 · GHSA-mc8v-mgrf-8f4m

Clarify Content-Type handling in OCI spec

LOW 27

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.02223 Published 2021-11-17 Partial fix · 1.0.1 CWE-843