Red Hat Security Advisory

RHSA-2022:6429

Migration Toolkit for Containers (MTC) 1.7.4 security and bug fix update

Released 2022-09-13 · Red Hat rating Important · View on Red Hat →

Fixed in

8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-registry-rhel8 +7

Fixes 8 records

TI-2021-06035 CVE-2021-23337 · GHSA-35jh-r3h4-6jhm

Command injection in Lodash

MEDIUM 59

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.21333 Published 2021-02-15 Partial fix · 4.17.21 CWE-94

TI-2022-00605 CVE-2022-0691 · GHSA-jf5r-8hm2-f872

Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

MEDIUM 46

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0222 Published 2022-02-21 Partial fix · 1.5.9 CWE-639

TI-2022-01520 CVE-2022-1650 · GHSA-6h5x-7c5m-7cr7

Improper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsource

MEDIUM 44

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.01861 Published 2022-05-12 Partial fix · v2.0.2, v1.1.1 +2 CWE-212

TI-2022-00600 CVE-2022-0686 · GHSA-hgjh-723h-mx2j

Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

MEDIUM 43

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01827 Published 2022-02-20 Partial fix · 1.5.8 CWE-639

TI-2020-17303 CVE-2020-28500 · GHSA-29mw-wpgm-hmr9

Regular expression denial of service (ReDoS) in Lodash

MEDIUM 40

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.07336 Published 2021-02-15 Partial fix · 4.17.21 CWE-1333

TI-2022-12767 CVE-2022-30631 · GHSA-r654-8j96-crqx

Stack exhaustion when reading certain archives in compress/gzip

LOW 37

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compres…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02186 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674

TI-2022-00432 CVE-2022-0512 · GHSA-rqff-837h-mm52

Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

LOW 28

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01782 Published 2022-02-14 Partial fix · 1.5.6 CWE-639

TI-2022-00556 CVE-2022-0639 · GHSA-8v38-pw62-9cw2

Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

LOW 27

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01535 Published 2022-02-17 Partial fix · 1.5.7 CWE-639