Red Hat Security AdvisoryRHSA-2022:8750
OpenShift Virtualization 4.11.1 security and bug fix update
Released 2022-12-01 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
Fixes 5 records
Priority MEDIUM 45
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0995 · Published 2022-04-20 · Partial fix CWE-674
Priority MEDIUM 42
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01484 · Published 2022-12-26 · Partial fix · 0.3.7 CWE-125
Priority MEDIUM 40
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0416 · Published 2022-04-20 · Partial fix
Priority LOW 39
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03228 · Published 2022-03-05 · Partial fix CWE-674
Priority LOW 18
Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during…
CVSS 3.1LOW 3.1· Network · No auth · User interaction · EPSS 0.0121 · Published 2022-08-09 · Partial fix · 1.17.11, 1.18.3 CWE-330
THREATIST.IORead the docs