Red Hat Security Advisory

RHSA-2022:5201

Red Hat Advanced Cluster Management 2.4.5 security updates and bug fixes

Released 2022-06-27 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47

Fixes 8 records

TI-2022-08598 CVE-2022-24785 · GHSA-8hfj-j24r-96c4

Path Traversal in Moment.js

MEDIUM 54

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.1384 Published 2022-04-04 Partial fix · 2.29.2 CWE-22

TI-2022-07828 CVE-2022-23806 · GHSA-8c83-vp4v-h7fq

Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can…

MEDIUM 45

Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.03073 Published 2022-02-11 Partial fix CWE-252

TI-2022-08320 CVE-2022-24450 · GHSA-g6w6-r76c-28j7

NATS nats-server before 2.7.2 has Incorrect Access Control.

MEDIUM 41

NATS nats-server before 2.7.2 has Incorrect Access Control.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0133 Published 2022-02-08 Partial fix · 2.7.2, 0.24.1 CWE-862

TI-2022-09229 CVE-2022-25645 · GHSA-23wx-cgxq-vpwx

All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protory…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0184 Published 2022-05-01 Partial fix · 3.1.2 CWE-1321

TI-2022-06175 CVE-2022-21803 · GHSA-6xwr-q98w-rvg7

Prototype pollution in nconf

LOW 36

This affects the package nconf before 0.11.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0178 Published 2022-04-12 Partial fix · 0.11.4 CWE-1321

TI-2021-19455 CVE-2021-43565 · GHSA-gwc9-m7rh-j2ww

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto…

LOW 35

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01193 Published 2022-09-06 Partial fix · 0.0.0-20211202192323-5770296d904e

TI-2022-11985 CVE-2022-29526 · GHSA-p782-xgp4-8hr8

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment.

LOW 29

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02951 Published 2022-06-22 Partial fix · 0.0.0-20220412211240-33da011f77ad CWE-269

TI-2022-12170 CVE-2022-29810 · GHSA-27rq-4943-qcwp

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.

LOW 25

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0041 Published 2022-04-27 Partial fix · 1.5.11 CWE-532