Skip to content
OpenAdvisories
High RHSA-2022:6277 7 CVEs

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.5 security update

Published Sep 30, 2024 · Updated Oct 15, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · Service Mesh 2 service_mesh:2.1::el8 servicemesh 0:2.1.5-1.el8
Red Hat · Service Mesh 2 service_mesh:2.1::el8 servicemesh-cni 0:2.1.5-1.el8
Red Hat · Service Mesh 2 service_mesh:2.1::el8 servicemesh-operator 0:2.1.5-1.el8
Red Hat · Service Mesh 2 service_mesh:2.1::el8 servicemesh-pilot-agent 0:2.1.5-1.el8
Red Hat · Service Mesh 2 service_mesh:2.1::el8 servicemesh-pilot-discovery 0:2.1.5-1.el8
Red Hat · Service Mesh 2 service_mesh:2.1::el8 servicemesh-prometheus 0:2.23.0-9.el8
Red Hat · Service Mesh 2 service_mesh:2.1::el8 servicemesh-proxy 0:2.1.5-1.el8
Red Hat · Service Mesh 2 service_mesh:2.1::el8 servicemesh-proxy-debuginfo 0:2.1.5-1.el8
Red Hat · Service Mesh 2 service_mesh:2.1::el8 servicemesh-proxy-debugsource 0:2.1.5-1.el8
Red Hat · Service Mesh 2 service_mesh:2.1::el8 servicemesh-proxy-wasm 0:2.1.5-1.el8
Red Hat · Service Mesh 2 service_mesh:2.1::el8 servicemesh-ratelimit 0:2.1.5-1.el8

Vulnerabilities 7

  • High 7.5
    CVE-2022-24785 Public exploit EPSS 14%

    Path Traversal in Moment.js

    Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is direct…

    moment moment node-moment node-moment Debian Ubuntu npm NuGet
  • High 7.5
    CVE-2022-31129

    Inefficient Regular Expression Complexity in moment

    moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 par…

    moment moment mediawiki wordpress Debian Ubuntu npm NuGet
  • Medium 5.3
    CVE-2022-29526

    golang.org/x/sys/unix has Incorrect privilege reporting in syscall

    Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

    golang stdlib k3d golang-1.8 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Low 3.1
    CVE-2022-30629

    Session tickets lack random ticket_age_add in crypto/tls

    Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

    Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-24675 Public exploit

    Stack overflow from a large amount of PEM data in encoding/pem

    encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

    golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-24921

    Stack exhaustion when compiling deeply nested expressions in regexp

    regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-28327

    Panic due to large inputs affecting P-256 curves in crypto/elliptic

    The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

    golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2064857
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2072009
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2077688
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2077689
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2084085
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2092793
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2105075
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6277.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-24675
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-24675
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-24675
  • article
    https://groups.google.com/g/golang-announce/c/oecdBNLOml8
  • report
    https://access.redhat.com/security/cve/CVE-2022-24785
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-24785
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-24785
  • article
    https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4
  • report
    https://access.redhat.com/security/cve/CVE-2022-24921
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-24921
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-24921
  • article
    https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk
  • report
    https://access.redhat.com/security/cve/CVE-2022-28327
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-28327
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-28327
  • report
    https://access.redhat.com/security/cve/CVE-2022-29526
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-29526
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-29526
  • article
    https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU
  • report
    https://access.redhat.com/security/cve/CVE-2022-30629
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-30629
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-30629
  • article
    https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg
  • report
    https://access.redhat.com/security/cve/CVE-2022-31129
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-31129
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-31129
  • article
    https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g