Skip to content
OpenAdvisories
Unscored RHSA-2022:6094 4 CVEs

Red Hat Security Advisory: OpenShift Container Platform 4.10.28 packages and security update

Published Sep 30, 2024 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · OpenShift 4 openshift:4.10::el7 cri-o 0:1.23.3-13.rhaos4.10.git6af791c.1.el7
Red Hat · OpenShift 4 openshift:4.10::el7 cri-o-debuginfo 0:1.23.3-13.rhaos4.10.git6af791c.1.el7
Red Hat · OpenShift 4 openshift:4.10::el8 cri-o 0:1.23.3-14.rhaos4.10.git6af791c.1.el8
Red Hat · OpenShift 4 openshift:4.10::el8 cri-o-debuginfo 0:1.23.3-14.rhaos4.10.git6af791c.1.el8
Red Hat · OpenShift 4 openshift:4.10::el8 cri-o-debugsource 0:1.23.3-14.rhaos4.10.git6af791c.1.el8

Vulnerabilities 4

  • Unscored —
    CVE-2022-23773 Public exploit

    Incorrect access control in the go command in cmd/go/internal/modfetch

    cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

    golang go golang-1.8 golang-1.13 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-23806

    Incorrect computation for some invalid field elements in crypto/elliptic

    Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

    golang go stdlib lxd Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-24675 Public exploit

    Stack overflow from a large amount of PEM data in encoding/pem

    encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

    golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-28327

    Panic due to large inputs affecting P-256 curves in crypto/elliptic

    The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

    golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2053429
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2053541
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2077688
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2077689
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6094.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-23773
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-23773
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-23773
  • article
    https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
  • report
    https://access.redhat.com/security/cve/CVE-2022-23806
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-23806
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-23806
  • report
    https://access.redhat.com/security/cve/CVE-2022-24675
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-24675
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-24675
  • article
    https://groups.google.com/g/golang-announce/c/oecdBNLOml8
  • report
    https://access.redhat.com/security/cve/CVE-2022-28327
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-28327
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-28327