Red Hat Security Advisory: OpenShift Container Platform 4.12.0 packages and security update

Fixed packages 400

Vulnerabilities 16

• High 7.5
  CVE-2022-27664

  golang.org/x/net/http2 Denial of Service vulnerability

  In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-pbt-enas katib-suggestion-optuna-enas Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2022
• High 7.5
  CVE-2022-30631

  Stack exhaustion when reading certain archives in compress/gzip

  Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

  Go standard library compress/gzip golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• High 7.4
  CVE-2022-2996

  python-scciclient vulnerable to Man-in-the-middle (MITM) attacks

  A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM) attacks.

  python-scciclient python-scciclient python-scciclient Debian Ubuntu PyPI
  Sep 1, 2022
• High 7.4
  CVE-2022-3259

  Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.

  Dec 9, 2022
• High 7.1
  CVE-2022-2995

  CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure

  Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set acc…

  cri-o github.com/cri-o/cri-o Azure Linux Go
  Sep 19, 2022
• Medium 6.5
  CVE-2022-1705

  Improper sanitization of Transfer-Encoding headers in net/http

  Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 6.5
  CVE-2022-3162

  Unauthorized read of Custom Resources

  Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. T…

  Kubernetes Kubernetes kubernetes cert-manager Debian Azure Linux Go
  Mar 1, 2023
• Medium 6.5
  CVE-2022-32148

  Exposure of client IP addresses in net/http

  Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set …

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 5.5
  CVE-2021-4235

  Denial of service in gopkg.in/yaml.v2

  Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.

  gopkg.in/yaml.v2 github.com/go-yaml/yaml gopkg.in/yaml.v2 github.com/go-yaml/yaml Debian Ubuntu Azure Linux Wolfi Go
  Dec 27, 2022
• Medium 5.1
  CVE-2022-3172 Public exploit

  Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)

  A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third partie…

  Kubernetes kube-apiserver kubernetes Debian
  Nov 3, 2023
• Medium 4.8
  CVE-2022-3466

  Cri-o: security regression of cve-2022-27652

  The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was pr…

  Red Hat Red Hat OpenShift Container Platform 4.12 Red Hat OpenShift Container Platform 3.11
  Sep 15, 2023
• Unscored —
  CVE-2022-2879

  Unbounded memory consumption when reading headers in archive/tar

  Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …

  Go standard library archive/tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-2880

  Incorrect sanitization of forwarded query parameters in net/http/httputil

  Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…

  Go standard library net/http/httputil katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-32189

  Panic when decoding Float and Rat types in math/big

  A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

  Go standard library math/big golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Unscored —
  CVE-2022-32190

  Failure to strip relative path components in net/url

  JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from …

  Go standard library net/url katib-suggestion-hyperopt katib-earlystopping Debian Alpine Wolfi Go
  Sep 13, 2022
• Unscored —
  CVE-2022-41715

  Memory exhaustion when compiling regular expressions in regexp/syntax

  Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…

  Go standard library regexp/syntax katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2103220
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107342
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2113814
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2121632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2124669
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2127804
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132868
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134063
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136673
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156727
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2022_7398.json
• report
  https://access.redhat.com/security/cve/CVE-2021-4235
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-4235
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-4235
• article
  https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241
• article
  https://github.com/go-yaml/yaml/pull/375
• advisory
  https://pkg.go.dev/vuln/GO-2021-0061
• report
  https://access.redhat.com/security/cve/CVE-2022-1705
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107374
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1705
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1705
• article
  https://go.dev/issue/53188
• article
  https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
• report
  https://access.redhat.com/security/cve/CVE-2022-2879
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132867
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2879
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2879
• article
  https://github.com/golang/go/issues/54853
• article
  https://github.com/vbatts/tar-split/releases/tag/v0.12.1
• article
  https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1
• report
  https://access.redhat.com/security/cve/CVE-2022-2880
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2880
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2880
• article
  https://github.com/golang/go/issues/54663
• report
  https://access.redhat.com/security/cve/CVE-2022-2995
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2995