Red Hat Security Advisory: OpenShift Container Platform 4.9.59 security update

Fixed packages 1

Vulnerabilities 1

• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven
  Oct 13, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135435
• article
  https://issues.redhat.com/browse/OCPBUGS-11081
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1524.json
• report
  https://access.redhat.com/security/cve/CVE-2022-42889
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-42889
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-42889
• article
  https://blogs.apache.org/security/entry/cve-2022-42889
• article
  https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
• article
  https://seclists.org/oss-sec/2022/q4/22