Red Hat Security Advisory: Image Builder security, bug fix, and enhancement update

Fixed packages 13

Vulnerabilities 5

• High 7.5
  CVE-2022-27664

  golang.org/x/net/http2 Denial of Service vulnerability

  In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-pbt-enas katib-suggestion-optuna-enas Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2022
• Medium 5.3
  CVE-2022-41717 Public exploit

  Excessive memory growth in net/http and golang.org/x/net/http2

  An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 8, 2022
• Unscored —
  CVE-2022-2879

  Unbounded memory consumption when reading headers in archive/tar

  Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …

  Go standard library archive/tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-2880

  Incorrect sanitization of forwarded query parameters in net/http/httputil

  Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…

  Go standard library net/http/httputil katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-41715

  Memory exhaustion when compiling regular expressions in regexp/syntax

  Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…

  Go standard library regexp/syntax katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2033192
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2063126
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072834
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2124669
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132254
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132867
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132868
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2139721
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2141738
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161274
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2168666
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2780.json
• report
  https://access.redhat.com/security/cve/CVE-2022-2879
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2879
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2879
• article
  https://github.com/golang/go/issues/54853
• article
  https://github.com/vbatts/tar-split/releases/tag/v0.12.1
• article
  https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1
• report
  https://access.redhat.com/security/cve/CVE-2022-2880
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2880
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2880
• article
  https://github.com/golang/go/issues/54663
• report
  https://access.redhat.com/security/cve/CVE-2022-27664
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-27664
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-27664
• article
  https://go.dev/issue/54658
• article
  https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ
• report
  https://access.redhat.com/security/cve/CVE-2022-41715
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41715
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41715
• article
  https://github.com/golang/go/issues/55949
• report
  https://access.redhat.com/security/cve/CVE-2022-41717
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41717
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41717
• article
  https://go.dev/cl/455635