Red Hat Security AdvisoryRHSA-2022:4956
Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes
Released 2022-06-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/acm-cluster-proxy-rhel8, rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8 +47
Fixes 14 records
Priority HIGH 77
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.73188 · Published 2022-03-15 · Partial fix · 300.0.5, 111.18.0 CWE-835
Priority HIGH 74
containerd is an open source container runtime.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.01809 · Published 2022-01-05 · Partial fix · 1.5.9 CWE-281
Priority HIGH 72
The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02718 · Published 2022-03-25 · Partial fix · 1.1.4 CWE-863
Priority MEDIUM 64
MinIO is a Kubernetes native application for cloud storage.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.35462 · Published 2021-12-27 · Partial fix CWE-269
Priority MEDIUM 54
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.1384 · Published 2022-04-04 · Partial fix · 2.29.2 CWE-22
Priority MEDIUM 49
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0383 · Published 2021-11-13 · Partial fix · 0.4.0 CWE-1321
Priority MEDIUM 45
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.03073 · Published 2022-02-11 · Partial fix CWE-252
Priority MEDIUM 41
NATS nats-server before 2.7.2 has Incorrect Access Control.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0133 · Published 2022-02-08 · Partial fix · 2.7.2, 0.24.1 CWE-862
Priority MEDIUM 40
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03963 · Published 2022-03-18 · Partial fix · 0.0.0-20220314234659-1baeb1ce4c0b CWE-327
Priority LOW 36
This affects the package nconf before 0.11.4.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0178 · Published 2022-04-12 · Partial fix · 0.11.4 CWE-1321
Priority LOW 35
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01193 · Published 2022-09-06 · Partial fix · 0.0.0-20211202192323-5770296d904e
Priority LOW 31
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01653 · Published 2022-01-16 · Partial fix · 3.1.1, 2.6.7 CWE-200
Priority LOW 27
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content.
CVSS 3.1MEDIUM 5.0· Network · Low privileges · No interaction · EPSS 0.02223 · Published 2021-11-17 · Partial fix · 1.0.1 CWE-843
Priority LOW 25
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.0041 · Published 2022-04-27 · Partial fix · 1.5.11 CWE-532
THREATIST.IORead the docs