Red Hat Security Advisory: OpenShift Container Platform 4.11.0 packages and security update

Fixed packages 400

Vulnerabilities 12

• High 7.5
  CVE-2021-43565

  x/crypto/ssh vulnerable to panic via malformed packets

  The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

  k3d k3d-proxy k3d-tools cri-o Debian Ubuntu Azure Linux Wolfi Go
  Sep 6, 2022
• High 7.5
  CVE-2022-21698

  Uncontrolled Resource Consumption in promhttp

  client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Ser…

  prometheus client_golang cri-o dynamic-localpv-provisioner Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 15, 2022
• High 7.5
  CVE-2022-27191

  golang.org/x/crypto/ssh Denial of service via crafted Signer

  The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

  go k3d k3d-proxy k3d-tools Debian Ubuntu Alpine Wolfi Go
  Mar 18, 2022
• Medium 6.5
  CVE-2022-1705

  Improper sanitization of Transfer-Encoding headers in net/http

  Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 6.5
  CVE-2022-1706

  Ignition config accessible to unprivileged software on VMware

  A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from th…

  cluster-api-aws-controller github.com/coreos/ignition/v2 github.com/coreos/ignition ignition Debian Ubuntu Wolfi Go
  May 17, 2022
• Medium 5.9
  CVE-2022-29162

  Incorrect Default Permissions in runc

  runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an aty…

  opencontainers runc ctop podman Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 17, 2022
• Unscored —
  CVE-2022-23772

  Uncontrolled memory consumption in math/big

  Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Feb 11, 2022
• Unscored —
  CVE-2022-23773 Public exploit

  Incorrect access control in the go command in cmd/go/internal/modfetch

  cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

  golang go golang-1.8 golang-1.13 Debian Ubuntu Azure Linux Alpine Go
  Feb 11, 2022
• Unscored —
  CVE-2022-23806

  Incorrect computation for some invalid field elements in crypto/elliptic

  Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

  golang go stdlib lxd Debian Ubuntu Azure Linux Alpine Go
  Feb 11, 2022
• Unscored —
  CVE-2022-24675 Public exploit

  Stack overflow from a large amount of PEM data in encoding/pem

  encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

  golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go
  Apr 20, 2022
• Unscored —
  CVE-2022-24921

  Stack exhaustion when compiling deeply nested expressions in regexp

  regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Mar 5, 2022
• Unscored —
  CVE-2022-28327

  Panic due to large inputs affecting P-256 curves in crypto/elliptic

  The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

  golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go
  Apr 20, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2045880
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053429
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053532
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053541
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2064702
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2064857
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2077688
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2077689
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2082274
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2086398
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5068.json
• report
  https://access.redhat.com/security/cve/CVE-2021-43565
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030787
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43565
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-43565
• report
  https://access.redhat.com/security/cve/CVE-2022-1705
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107374
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1705
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1705
• article
  https://go.dev/issue/53188
• article
  https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
• report
  https://access.redhat.com/security/cve/CVE-2022-1706
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1706
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1706
• report
  https://access.redhat.com/security/cve/CVE-2022-21698
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-21698
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-21698
• article
  https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p
• report
  https://access.redhat.com/security/cve/CVE-2022-23772
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-23772
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-23772
• article
  https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
• report
  https://access.redhat.com/security/cve/CVE-2022-23773
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-23773
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-23773
• report
  https://access.redhat.com/security/cve/CVE-2022-23806
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-23806
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-23806