Red Hat Migration Toolkit for Containers: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 9

• High 7.8
  CVE-2021-43138

  Prototype Pollution in async

  In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

  async npm
  Apr 6, 2022
• High 7.5
  CVE-2022-27664

  golang.org/x/net/http2 Denial of Service vulnerability

  In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-pbt-enas katib-suggestion-optuna-enas Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2022
• High 7.5
  CVE-2022-32149

  Denial of service via crafted Accept-Language header in golang.org/x/text/language

  An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

  golang.org/x/text golang.org/x/text/language k3d k3d-proxy Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Medium 5.3
  CVE-2022-41717 Public exploit

  Excessive memory growth in net/http and golang.org/x/net/http2

  An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 8, 2022
• Unscored —
  CVE-2022-2879

  Unbounded memory consumption when reading headers in archive/tar

  Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …

  Go standard library archive/tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-2880

  Incorrect sanitization of forwarded query parameters in net/http/httputil

  Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…

  Go standard library net/http/httputil katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-32189

  Panic when decoding Float and Rat types in math/big

  A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

  Go standard library math/big golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Unscored —
  CVE-2022-32190

  Failure to strip relative path components in net/url

  JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from …

  Go standard library net/url katib-suggestion-hyperopt katib-earlystopping Debian Alpine Wolfi Go
  Sep 13, 2022
• Unscored —
  CVE-2022-41715

  Memory exhaustion when compiling regular expressions in regexp/syntax

  Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…

  Go standard library regexp/syntax katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022

Revision history

1. 2025-04-29 #11

   Neue Updates von Amazon aufgenommen

2. 2024-05-21 #10

   Neue Updates von Red Hat aufgenommen

3. 2024-01-14 #9

   Neue Updates von Oracle Linux aufgenommen

4. 2024-01-01 #8

   Neue Updates von Red Hat aufgenommen

5. 2023-06-15 #7

   Neue Updates von Red Hat aufgenommen

6. 2023-04-26 #6

   Neue Updates von Red Hat aufgenommen

7. 2023-02-21 #5

   Neue Updates von Red Hat aufgenommen

8. 2023-02-20 #4

   Neue Updates von Red Hat aufgenommen

9. 2023-02-16 #3

   Neue Updates von Red Hat aufgenommen

10. 2023-02-15 #2

    Neue Updates von Red Hat aufgenommen

11. 2023-02-08 #1

    Initiale Fassung

References

• RedHat Security Advisory vom 2023-02-08
  https://access.redhat.com/errata/RHSA-2023:0693
• Red Hat Security Advisory RHSA-2023:0632 vom 2023-02-15
  https://access.redhat.com/errata/RHSA-2023:0632
• Red Hat Security Advisory RHSA-2023:0728 vom 2023-02-17
  https://access.redhat.com/errata/RHSA-2023:0728
• Red Hat Security Advisory RHSA-2023:0769 vom 2023-02-21
  https://access.redhat.com/errata/RHSA-2023:0769
• Red Hat Security Advisory RHSA-2023:0774 vom 2023-02-22
  https://access.redhat.com/errata/RHSA-2023:0774
• Red Hat Security Advisory RHSA-2023:2041 vom 2023-04-27
  https://access.redhat.com/errata/RHSA-2023:2041
• Red Hat Security Advisory RHSA-2023:3645 vom 2023-06-16
  https://access.redhat.com/errata/RHSA-2023:3645
• Red Hat Security Advisory RHSA-2023:5006 vom 2023-12-30
  https://access.redhat.com/errata/RHSA-2023:5006
• Oracle Linux Security Advisory ELSA-2024-0121 vom 2024-01-13
  https://linux.oracle.com/errata/ELSA-2024-0121.html
• Red Hat Security Advisory RHSA-2024:2988 vom 2024-05-22
  https://access.redhat.com/errata/RHSA-2024:2988
• Amazon Linux Security Advisory ALASDOCKER-2025-061 vom 2025-04-29
  https://alas.aws.amazon.com/AL2/ALASDOCKER-2025-061.html