Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.27.0

Fixed packages 1

Vulnerabilities 4

• High 7.5
  CVE-2022-27664

  golang.org/x/net/http2 Denial of Service vulnerability

  In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-hyperband katib-suggestion-pbt-enas Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2022
• Unscored —
  CVE-2022-2879

  Unbounded memory consumption when reading headers in archive/tar

  Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …

  Go standard library archive/tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-2880

  Incorrect sanitization of forwarded query parameters in net/http/httputil

  Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…

  Go standard library net/http/httputil katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-41715

  Memory exhaustion when compiling regular expressions in regexp/syntax

  Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…

  Go standard library regexp/syntax katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index
• article
  https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index
• article
  https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
• article
  https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html/serverless/index
• article
  https://access.redhat.com/documentation/en-us/openshift_container_platform/4.12/html/serverless/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2124669
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132867
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132868
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2154756
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0708.json
• report
  https://access.redhat.com/security/cve/CVE-2022-2879
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2879
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2879
• article
  https://github.com/golang/go/issues/54853
• article
  https://github.com/vbatts/tar-split/releases/tag/v0.12.1
• article
  https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1
• report
  https://access.redhat.com/security/cve/CVE-2022-2880
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2880
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2880
• article
  https://github.com/golang/go/issues/54663
• report
  https://access.redhat.com/security/cve/CVE-2022-27664
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-27664
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-27664
• article
  https://go.dev/issue/54658
• article
  https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ
• report
  https://access.redhat.com/security/cve/CVE-2022-41715
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41715
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41715
• article
  https://github.com/golang/go/issues/55949