Red Hat Security Advisory: OpenShift Container Storage 3.11.z security and bug fix update

Fixed packages 5

Vulnerabilities 2

• Medium 5.9
  CVE-2021-31525

  golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion

  net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

  go stdlib k3d golang-1.16 Debian Ubuntu Alpine Wolfi Go
  May 27, 2021
• Unscored —
  CVE-2021-3114

  Incorrect operations on the P-224 curve in crypto/elliptic

  In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Jan 26, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1918750
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1958341
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1979199
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2012287
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0308.json
• report
  https://access.redhat.com/security/cve/CVE-2021-3114
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3114
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3114
• article
  https://groups.google.com/g/golang-announce/c/mperVMGa98w
• report
  https://access.redhat.com/security/cve/CVE-2021-31525
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-31525
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-31525
• article
  https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc