Red Hat Security Advisory

RHSA-2022:9096

Red Hat OpenShift support for Windows Containers 7.0.0 [security update]

Released 2023-01-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.12 openshift4-wincw/windows-machine-config-rhel8-operator

Fixes 3 records

TI-2022-06074 CVE-2022-21698 · GHSA-cg3q-j54f-5p7p

Uncontrolled Resource Consumption in promhttp

MEDIUM 48

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05994 Published 2022-02-15 Partial fix · 1.11.1 CWE-400

TI-2022-10313 CVE-2022-27191 · GHSA-8c26-wmh5-6g9v

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go…

MEDIUM 40

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03963 Published 2022-03-18 Partial fix · 0.0.0-20220314234659-1baeb1ce4c0b CWE-327

TI-2021-07838 CVE-2021-25749 · GHSA-vv2r-w4hf-7mhr

runAsNonRoot logic bypass for Windows containers

LOW 35

Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00211 Published 2023-05-24 Partial fix · v1.22.14, v1.23.11 +1 CWE-284