Red Hat Security Advisory: OpenShift Container Platform 4.10.25 security update

Fixed packages 19

Vulnerabilities 6

• Medium 5.3
  CVE-2022-29526

  golang.org/x/sys/unix has Incorrect privilege reporting in syscall

  Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

  golang stdlib k3d golang-1.8 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 22, 2022
• Unscored —
  CVE-2022-23773 Public exploit

  Incorrect access control in the go command in cmd/go/internal/modfetch

  cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

  golang go golang-1.8 golang-1.13 Debian Ubuntu Azure Linux Alpine Go
  Feb 11, 2022
• Unscored —
  CVE-2022-23806

  Incorrect computation for some invalid field elements in crypto/elliptic

  Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

  golang go stdlib lxd Debian Ubuntu Azure Linux Alpine Go
  Feb 11, 2022
• Unscored —
  CVE-2022-24675 Public exploit

  Stack overflow from a large amount of PEM data in encoding/pem

  encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

  golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go
  Apr 20, 2022
• Unscored —
  CVE-2022-24921

  Stack exhaustion when compiling deeply nested expressions in regexp

  regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Mar 5, 2022
• Unscored —
  CVE-2022-28327

  Panic due to large inputs affecting P-256 curves in crypto/elliptic

  The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

  golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go
  Apr 20, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2064857
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2077688
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5729.json
• report
  https://access.redhat.com/security/cve/CVE-2022-23773
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053541
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-23773
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-23773
• article
  https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
• report
  https://access.redhat.com/security/cve/CVE-2022-23806
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053429
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-23806
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-23806
• report
  https://access.redhat.com/security/cve/CVE-2022-24675
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-24675
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-24675
• article
  https://groups.google.com/g/golang-announce/c/oecdBNLOml8
• report
  https://access.redhat.com/security/cve/CVE-2022-24921
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-24921
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-24921
• article
  https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk
• report
  https://access.redhat.com/security/cve/CVE-2022-28327
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2077689
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-28327
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-28327
• report
  https://access.redhat.com/security/cve/CVE-2022-29526
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2084085
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29526
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29526
• article
  https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU