Red Hat Security Advisory: OpenShift Container Platform 4.12.22 packages and security update

Fixed packages 128

Vulnerabilities 7

• High 7.5
  CVE-2022-27664

  golang.org/x/net/http2 Denial of Service vulnerability

  In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-skopt-enas katib-suggestion-hyperband Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2022
• High 7.5
  CVE-2022-32149

  Denial of service via crafted Accept-Language header in golang.org/x/text/language

  An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

  golang.org/x/text golang.org/x/text/language k3d k3d-proxy Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• High 7.1
  CVE-2022-2989

  Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification

  An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to…

  podman podman github.com/containers/podman/v4 github.com/containers/podman/v3 Debian Ubuntu Azure Linux Alpine Go
  Sep 13, 2022
• Unscored —
  CVE-2022-2879

  Unbounded memory consumption when reading headers in archive/tar

  Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …

  Go standard library archive/tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-2880

  Incorrect sanitization of forwarded query parameters in net/http/httputil

  Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…

  Go standard library net/http/httputil katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-32190

  Failure to strip relative path components in net/url

  JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from …

  Go standard library net/url katib-suggestion-hyperopt katib-earlystopping Debian Alpine Wolfi Go
  Sep 13, 2022
• Unscored —
  CVE-2022-41715

  Memory exhaustion when compiling regular expressions in regexp/syntax

  Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…

  Go standard library regexp/syntax katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2124668
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2124669
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132867
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132868
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134010
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3613.json
• report
  https://access.redhat.com/security/cve/CVE-2022-2879
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2879
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2879
• article
  https://github.com/golang/go/issues/54853
• article
  https://github.com/vbatts/tar-split/releases/tag/v0.12.1
• article
  https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1
• report
  https://access.redhat.com/security/cve/CVE-2022-2880
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2880
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2880
• article
  https://github.com/golang/go/issues/54663
• report
  https://access.redhat.com/security/cve/CVE-2022-2989
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2121445
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2989
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2989
• article
  https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
• report
  https://access.redhat.com/security/cve/CVE-2022-27664
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-27664
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-27664
• article
  https://go.dev/issue/54658
• article
  https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ
• report
  https://access.redhat.com/security/cve/CVE-2022-32149
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32149
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32149
• article
  https://go.dev/issue/56152
• article
  https://groups.google.com/g/golang-dev/c/qfPIly0X7aU
• report
  https://access.redhat.com/security/cve/CVE-2022-32190
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-32190
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-32190
• article
  https://go.dev/issue/54385
• report
  https://access.redhat.com/security/cve/CVE-2022-41715