Read the docs
Red Hat Security Advisory

RHSA-2022:8626

OpenShift Container Platform 4.11.17 packages and security update

Released 2022-11-28 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 4 records

TI-2022-13904 CVE-2022-32189 · GHSA-3rm2-w8f7-h7rf

Panic when decoding Float and Rat types in math/big

Priority MEDIUM 44

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02781 Published 2022-08-09 Partial fix · 1.17.13, 1.18.5
TI-2022-10644 CVE-2022-27664 · GHSA-69cg-p879-7622

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of…

Priority LOW 39

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03487 Published 2022-09-06 Partial fix · 0.0.0-20220906165146-f3363e06e74c
TI-2022-13881 CVE-2022-32148 · GHSA-f839-v4x8-wvr3

Exposure of client IP addresses in net/http

Priority LOW 38

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For he…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01517 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4
TI-2022-01571 CVE-2022-1705 · GHSA-5hv8-7f46-fxf6

Improper sanitization of Transfer-Encoding headers in net/http

Priority LOW 32

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to re…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01531 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-444