Red Hat Security AdvisoryRHSA-2022:5068
OpenShift Container Platform 4.11.0 packages and security update
Released 2022-08-10 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Ironic content for Red Hat OpenShift Container Platform 4.11 libsodium-1.0.16-5.el8, libsodium-devel-1.0.16-5.el8, libsodium-static-1.0.16-5.el8 +47
- Red Hat OpenShift Container Platform 4.11 afterburn-5.3.0-1.rhaos4.11.el8, atomic-openshift-service-idler-4.11.0-202206222028.p0.g39cfc66.assembly.stream.el8, bootupd-0.2.5-3.rhaos4.11.el8 +47
Fixes 12 records
Priority MEDIUM 48
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05994 · Published 2022-02-15 · Partial fix · 1.11.1 CWE-400
Priority MEDIUM 45
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0995 · Published 2022-04-20 · Partial fix CWE-674
Priority MEDIUM 45
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.03073 · Published 2022-02-11 · Partial fix CWE-252
Priority MEDIUM 40
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0416 · Published 2022-04-20 · Partial fix
Priority MEDIUM 40
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03963 · Published 2022-03-18 · Partial fix · 0.0.0-20220314234659-1baeb1ce4c0b CWE-327
Priority LOW 39
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03228 · Published 2022-03-05 · Partial fix CWE-674
Priority LOW 38
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02676 · Published 2022-02-11 · Partial fix CWE-436
Priority LOW 38
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02807 · Published 2022-02-11 · Partial fix CWE-190
Priority LOW 35
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01193 · Published 2022-09-06 · Partial fix · 0.0.0-20211202192323-5770296d904e
Priority LOW 34
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0039 · Published 2022-05-17 · Partial fix · 1.1.2 CWE-276
Priority LOW 32
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to re…
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01531 · Published 2022-08-09 · Partial fix · 1.17.12, 1.18.4 CWE-444
Priority LOW 31
A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01298 · Published 2022-05-17 · Fixed in 2.14.0 CWE-863
THREATIST.IORead the docs