Red Hat Security AdvisoryRHSA-2022:5673
Release of containers for OSP 16.2.z director operator tech preview
Released 2022-07-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenStack Platform 16.2 rhosp-rhel8-tech-preview/osp-director-downloader, rhosp-rhel8-tech-preview/osp-director-operator
Fixes 6 records
Priority MEDIUM 46
go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01743 · Published 2022-05-25 · Partial fix · 1.6.1, 2.1.0 CWE-77
Priority MEDIUM 43
go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.03114 · Published 2022-05-25 · Partial fix · 1.6.1, 2.1.0 CWE-22
Priority MEDIUM 40
go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.01462 · Published 2022-05-25 · Partial fix · 1.6.1, 2.1.0
Priority MEDIUM 40
go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.01462 · Published 2022-05-25 · Partial fix · 1.6.1, 2.1.0
Priority LOW 35
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01193 · Published 2022-09-06 · Partial fix · 0.0.0-20211202192323-5770296d904e
Priority LOW 35
containerd is an open source container runtime with an emphasis on simplicity, robustness and portability.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00518 · Published 2021-10-04 · Partial fix · 1.4.11, 1.5.7 CWE-22
THREATIST.IORead the docs