Red Hat Security AdvisoryRHSA-2022:5729
OpenShift Container Platform 4.10.25 security update
Released 2022-08-01 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.10 atomic-openshift-service-idler-4.10.0-202207192015.p0.g39cfc66.assembly.stream.el8, cri-o-1.23.3-11.rhaos4.10.gitddf4b1a.1.el7, cri-o-1.23.3-11.rhaos4.10.gitddf4b1a.1.el8 +10
Fixes 6 records
Priority MEDIUM 45
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0995 · Published 2022-04-20 · Partial fix CWE-674
Priority MEDIUM 45
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.03073 · Published 2022-02-11 · Partial fix CWE-252
Priority MEDIUM 40
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0416 · Published 2022-04-20 · Partial fix
Priority LOW 39
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03228 · Published 2022-03-05 · Partial fix CWE-674
Priority LOW 38
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02676 · Published 2022-02-11 · Partial fix CWE-436
Priority LOW 29
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02951 · Published 2022-06-22 · Partial fix · 0.0.0-20220412211240-33da011f77ad CWE-269
THREATIST.IORead the docs