Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-41717 (GCVE-0-2022-41717)
Vulnerability from cvelistv5 – Published: 2022-12-08 19:03 – Updated: 2025-02-13 16:33
VLAI
EPSS
VEX
Title
Excessive memory growth in net/http and golang.org/x/net/http2
Summary
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
Severity
5.3 (Medium)
CWE
- CWE 400: Uncontrolled Resource Consumption
Assigner
References
24 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/http |
Affected:
0 , < 1.18.9
(semver)
Affected: 1.19.0-0 , < 1.19.4 (semver) |
|
| golang.org/x/net | golang.org/x/net/http2 |
Affected:
0 , < 0.4.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:49:43.657Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://security.netapp.com/advisory/ntap-20230120-0008/"
},
{
"tags": [
"x_transferred"
],
"url": "https://go.dev/issue/56350"
},
{
"tags": [
"x_transferred"
],
"url": "https://go.dev/cl/455717"
},
{
"tags": [
"x_transferred"
],
"url": "https://go.dev/cl/455635"
},
{
"tags": [
"x_transferred"
],
"url": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ"
},
{
"tags": [
"x_transferred"
],
"url": "https://pkg.go.dev/vuln/GO-2022-1144"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202311-09"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http",
"product": "net/http",
"programRoutines": [
{
"name": "http2serverConn.canonicalHeader"
},
{
"name": "ListenAndServe"
},
{
"name": "ListenAndServeTLS"
},
{
"name": "Serve"
},
{
"name": "ServeTLS"
},
{
"name": "Server.ListenAndServe"
},
{
"name": "Server.ListenAndServeTLS"
},
{
"name": "Server.Serve"
},
{
"name": "Server.ServeTLS"
},
{
"name": "http2Server.ServeConn"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.18.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.19.4",
"status": "affected",
"version": "1.19.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/net/http2",
"product": "golang.org/x/net/http2",
"programRoutines": [
{
"name": "serverConn.canonicalHeader"
},
{
"name": "Server.ServeConn"
}
],
"vendor": "golang.org/x/net",
"versions": [
{
"lessThan": "0.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Josselin Costanzi"
}
],
"descriptions": [
{
"lang": "en",
"value": "An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE 400: Uncontrolled Resource Consumption",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-18T02:06:25.182Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/56350"
},
{
"url": "https://go.dev/cl/455717"
},
{
"url": "https://go.dev/cl/455635"
},
{
"url": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ"
},
{
"url": "https://pkg.go.dev/vuln/GO-2022-1144"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/"
},
{
"url": "https://security.gentoo.org/glsa/202311-09"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/"
}
],
"title": "Excessive memory growth in net/http and golang.org/x/net/http2"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2022-41717",
"datePublished": "2022-12-08T19:03:53.161Z",
"dateReserved": "2022-09-28T17:00:06.608Z",
"dateUpdated": "2025-02-13T16:33:08.284Z",
"requesterUserId": "7d08541a-cd0a-42e2-8f81-76e6ceb65fc3",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2022-41717",
"date": "2026-08-14",
"epss": "0.05623",
"percentile": "0.92252"
},
"microsoft_vex": {
"current_release_date": "2026-02-18T03:20:12.000Z",
"cve": "CVE-2022-41717",
"id": "msrc_CVE-2022-41717",
"initial_release_date": "2022-12-02T00:00:00.000Z",
"product_status:fixed": "25",
"product_status:known_affected": "25",
"product_status:known_not_affected": "13",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "Excessive memory growth in net/http and golang.org/x/net/http2",
"url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2022-41717.json",
"version": "13"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-41717\",\"sourceIdentifier\":\"security@golang.org\",\"published\":\"2022-12-08T20:15:10.330\",\"lastModified\":\"2026-06-17T05:03:42.153\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.\"},{\"lang\":\"es\",\"value\":\"Un atacante puede provocar un crecimiento excesivo de la memoria en un servidor Go que acepta solicitudes HTTP/2. Las conexiones del servidor HTTP/2 contienen un cach\u00e9 de claves de encabezado HTTP enviadas por el cliente. Si bien el n\u00famero total de entradas en esta cach\u00e9 est\u00e1 limitado, un atacante que env\u00eda claves muy grandes puede hacer que el servidor asigne aproximadamente 64 MiB por conexi\u00f3n abierta.\"}],\"affected\":[{\"source\":\"security@golang.org\",\"affectedData\":[{\"vendor\":\"Go standard library\",\"product\":\"net/http\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"net/http\",\"programRoutines\":[{\"name\":\"http2serverConn.canonicalHeader\"},{\"name\":\"ListenAndServe\"},{\"name\":\"ListenAndServeTLS\"},{\"name\":\"Serve\"},{\"name\":\"ServeTLS\"},{\"name\":\"Server.ListenAndServe\"},{\"name\":\"Server.ListenAndServeTLS\"},{\"name\":\"Server.Serve\"},{\"name\":\"Server.ServeTLS\"},{\"name\":\"http2Server.ServeConn\"}],\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.18.9\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.19.0-0\",\"lessThan\":\"1.19.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"golang.org/x/net\",\"product\":\"golang.org/x/net/http2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"golang.org/x/net/http2\",\"programRoutines\":[{\"name\":\"serverConn.canonicalHeader\"},{\"name\":\"Server.ServeConn\"}],\"versions\":[{\"version\":\"0\",\"lessThan\":\"0.4.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.18.9\",\"matchCriteriaId\":\"E0CD51B1-029E-442F-BE6A-772F4754D240\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.19.0\",\"versionEndExcluding\":\"1.19.4\",\"matchCriteriaId\":\"B6AEBFD1-DEE2-40E0-B65C-8C7885014797\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:http2:*:*:*:*:*:go:*:*\",\"versionEndExcluding\":\"0.4.0\",\"matchCriteriaId\":\"BBFC0CE7-CD35-4FCF-A37A-DBC5D6DA16D2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E30D0E6F-4AE8-4284-8716-991DFA48CC5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9\"}]}]}],\"references\":[{\"url\":\"https://go.dev/cl/455635\",\"source\":\"security@golang.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://go.dev/cl/455717\",\"source\":\"security@golang.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://go.dev/issue/56350\",\"source\":\"security@golang.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ\",\"source\":\"security@golang.org\",\"tags\":[\"Mailing List\",\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/\",\"source\":\"security@golang.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/\",\"source\":\"security@golang.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/\",\"source\":\"security@golang.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/\",\"source\":\"security@golang.org\"},{\"url\":\"https://pkg.go.dev/vuln/GO-2022-1144\",\"source\":\"security@golang.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202311-09\",\"source\":\"security@golang.org\"},{\"url\":\"https://go.dev/cl/455635\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://go.dev/cl/455717\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://go.dev/issue/56350\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://pkg.go.dev/vuln/GO-2022-1144\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202311-09\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20230120-0008/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-14T22:41:43+00:00",
"cve": "CVE-2022-41717",
"id": "CVE-2022-41717",
"initial_release_date": "2022-11-30T00:00:00+00:00",
"product_status:fixed": "2105",
"product_status:known_affected": "138",
"product_status:known_not_affected": "7592",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-41717.json",
"version": "3"
}
}
}
MSRC_CVE-2022-41717
Vulnerability from csaf_microsoft - Published: 2022-12-02 00:00 - Updated: 2026-02-18 03:20Summary
Excessive memory growth in net/http and golang.org/x/net/http2
Notes
Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
5.3 (Medium)
Affected products
Fixed
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 20327-17086 | — | ||
| Unresolved product id: 20308-17086 | — | ||
| Unresolved product id: 20023-17086 | — | ||
| Unresolved product id: 17964-17084 | — | ||
| Unresolved product id: 20094-17084 | — | ||
| Unresolved product id: 20235-17084 | — | ||
| Unresolved product id: 19778-17086 | — | ||
| Unresolved product id: 19785-17086 | — | ||
| Unresolved product id: 18916-17086 | — | ||
| Unresolved product id: 18523-16820 | — | ||
| Unresolved product id: 17375-17086 | — | ||
| Unresolved product id: 18524-17086 | — | ||
| Unresolved product id: 18525-17086 | — | ||
| Unresolved product id: 17409-17086 | — | ||
| Unresolved product id: 18526-17086 | — | ||
| Unresolved product id: 18527-17086 | — | ||
| Unresolved product id: 17401-17086 | — | ||
| Unresolved product id: 17426-17086 | — | ||
| Unresolved product id: 18528-17084 | — | ||
| Unresolved product id: 18125-17084 | — | ||
| Unresolved product id: 17814-17084 | — | ||
| Unresolved product id: 18529-17084 | — | ||
| Unresolved product id: 20110-17086 | — | ||
| Unresolved product id: 19821-17086 | — | ||
| Unresolved product id: 19790-17086 | — |
Known affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 17086-2 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-3 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17084-32 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17084-7 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17084-5 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-15 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-14 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-21 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 16820-28 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-38 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-27 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-26 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-36 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-25 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-24 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-37 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-35 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17084-23 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17084-31 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17084-33 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17084-22 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-6 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-12 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 17086-13 | — |
Vendor Fix
fix
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 17086-4 | — | ||
| Unresolved product id: 17086-18 | — | ||
| Unresolved product id: 17086-9 | — | ||
| Unresolved product id: 17086-10 | — | ||
| Unresolved product id: 17084-29 | — | ||
| Unresolved product id: 17086-20 | — | ||
| Unresolved product id: 17084-34 | — | ||
| Unresolved product id: 17086-11 | — | ||
| Unresolved product id: 17086-30 | — | ||
| Unresolved product id: 17086-1 | — | ||
| Unresolved product id: 17086-16 | — | ||
| Unresolved product id: 17084-19 | — | ||
| Unresolved product id: 17084-17 | — |
References
4 references
| URL | Category |
|---|---|
| https://msrc.microsoft.com/csaf/vex/2022/msrc_cve… | self |
| https://support.microsoft.com/lifecycle | external |
| https://www.first.org/cvss | external |
| https://msrc.microsoft.com/csaf/vex/2022/msrc_cve… | self |
{
"document": {
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2022-41717 Excessive memory growth in net/http and golang.org/x/net/http2 - VEX",
"url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2022-41717.json"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "Excessive memory growth in net/http and golang.org/x/net/http2",
"tracking": {
"current_release_date": "2026-02-18T03:20:12.000Z",
"generator": {
"date": "2026-02-18T13:43:13.113Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2022-41717",
"initial_release_date": "2022-12-02T00:00:00.000Z",
"revision_history": [
{
"date": "2022-12-13T00:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
},
{
"date": "2024-01-24T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added sriov-network-device-plugin to CBL-Mariner 2.0"
},
{
"date": "2024-02-12T00:00:00.000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added nmi to CBL-Mariner 2.0"
},
{
"date": "2024-04-11T00:00:00.000Z",
"legacy_version": "1.3",
"number": "4",
"summary": "Added cri-o to CBL-Mariner 2.0"
},
{
"date": "2024-06-30T07:00:00.000Z",
"legacy_version": "1.4",
"number": "5",
"summary": "Information published."
},
{
"date": "2024-09-06T00:00:00.000Z",
"legacy_version": "1.5",
"number": "6",
"summary": "Information published."
},
{
"date": "2024-09-07T00:00:00.000Z",
"legacy_version": "1.6",
"number": "7",
"summary": "Information published."
},
{
"date": "2024-09-08T00:00:00.000Z",
"legacy_version": "1.7",
"number": "8",
"summary": "Information published."
},
{
"date": "2024-09-11T00:00:00.000Z",
"legacy_version": "1.8",
"number": "9",
"summary": "Information published."
},
{
"date": "2024-10-05T00:00:00.000Z",
"legacy_version": "1.9",
"number": "10",
"summary": "Information published."
},
{
"date": "2024-10-16T00:00:00.000Z",
"legacy_version": "2",
"number": "11",
"summary": "Added prometheus to CBL-Mariner 2.0\nAdded containerized-data-importer to CBL-Mariner 2.0\nAdded azcopy to CBL-Mariner 2.0\nAdded cri-o to CBL-Mariner 2.0\nAdded moby-cli to CBL-Mariner 2.0\nAdded nmi to CBL-Mariner 2.0\nAdded sriov-network-device-plugin to CBL-Mariner 2.0\nAdded golang to CBL-Mariner 2.0\nAdded moby-engine to Azure Linux 3.0\nAdded sriov-network-device-plugin to Azure Linux 3.0\nAdded prometheus to Azure Linux 3.0\nAdded golang to CBL-Mariner 1.0"
},
{
"date": "2024-12-03T00:00:00.000Z",
"legacy_version": "2.1",
"number": "12",
"summary": "Added containerized-data-importer to CBL-Mariner 2.0\nAdded prometheus to CBL-Mariner 2.0\nAdded azcopy to CBL-Mariner 2.0\nAdded cri-o to CBL-Mariner 2.0\nAdded moby-cli to CBL-Mariner 2.0\nAdded nmi to CBL-Mariner 2.0\nAdded sriov-network-device-plugin to CBL-Mariner 2.0\nAdded golang to CBL-Mariner 2.0\nAdded moby-engine to Azure Linux 3.0\nAdded sriov-network-device-plugin to Azure Linux 3.0\nAdded prometheus to Azure Linux 3.0\nAdded golang to CBL-Mariner 1.0"
},
{
"date": "2026-02-18T03:20:12.000Z",
"legacy_version": "3",
"number": "13",
"summary": "Information published."
}
],
"status": "final",
"version": "13"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "2.0",
"product": {
"name": "CBL Mariner 2.0",
"product_id": "17086"
}
},
{
"category": "product_version",
"name": "3.0",
"product": {
"name": "Azure Linux 3.0",
"product_id": "17084"
}
},
{
"category": "product_version",
"name": "1.0",
"product": {
"name": "CBL Mariner 1.0",
"product_id": "16820"
}
}
],
"category": "product_name",
"name": "Azure Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccbl2 prometheus 2.37.0-15",
"product": {
"name": "\u003ccbl2 prometheus 2.37.0-15",
"product_id": "2"
}
},
{
"category": "product_version",
"name": "cbl2 prometheus 2.37.0-15",
"product": {
"name": "cbl2 prometheus 2.37.0-15",
"product_id": "20327"
}
},
{
"category": "product_version_range",
"name": "\u003cazl3 prometheus 2.37.0-11",
"product": {
"name": "\u003cazl3 prometheus 2.37.0-11",
"product_id": "7"
}
},
{
"category": "product_version",
"name": "azl3 prometheus 2.37.0-11",
"product": {
"name": "azl3 prometheus 2.37.0-11",
"product_id": "20094"
}
},
{
"category": "product_version_range",
"name": "\u003ccbl2 prometheus 2.37.9-1",
"product": {
"name": "\u003ccbl2 prometheus 2.37.9-1",
"product_id": "36"
}
},
{
"category": "product_version",
"name": "cbl2 prometheus 2.37.9-1",
"product": {
"name": "cbl2 prometheus 2.37.9-1",
"product_id": "17409"
}
},
{
"category": "product_version_range",
"name": "\u003cazl3 prometheus 2.45.4-1",
"product": {
"name": "\u003cazl3 prometheus 2.45.4-1",
"product_id": "31"
}
},
{
"category": "product_version",
"name": "azl3 prometheus 2.45.4-1",
"product": {
"name": "azl3 prometheus 2.45.4-1",
"product_id": "18125"
}
}
],
"category": "product_name",
"name": "prometheus"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccbl2 sriov-network-device-plugin 3.5.1-3",
"product": {
"name": "\u003ccbl2 sriov-network-device-plugin 3.5.1-3",
"product_id": "3"
}
},
{
"category": "product_version",
"name": "cbl2 sriov-network-device-plugin 3.5.1-3",
"product": {
"name": "cbl2 sriov-network-device-plugin 3.5.1-3",
"product_id": "20308"
}
},
{
"category": "product_version_range",
"name": "\u003cazl3 sriov-network-device-plugin 3.5.1-3",
"product": {
"name": "\u003cazl3 sriov-network-device-plugin 3.5.1-3",
"product_id": "5"
}
},
{
"category": "product_version",
"name": "azl3 sriov-network-device-plugin 3.5.1-3",
"product": {
"name": "azl3 sriov-network-device-plugin 3.5.1-3",
"product_id": "20235"
}
},
{
"category": "product_version_range",
"name": "\u003ccbl2 sriov-network-device-plugin 3.6.2-2",
"product": {
"name": "\u003ccbl2 sriov-network-device-plugin 3.6.2-2",
"product_id": "26"
}
},
{
"category": "product_version",
"name": "cbl2 sriov-network-device-plugin 3.6.2-2",
"product": {
"name": "cbl2 sriov-network-device-plugin 3.6.2-2",
"product_id": "18525"
}
},
{
"category": "product_version_range",
"name": "\u003cazl3 sriov-network-device-plugin 3.7.0-1",
"product": {
"name": "\u003cazl3 sriov-network-device-plugin 3.7.0-1",
"product_id": "23"
}
},
{
"category": "product_version",
"name": "azl3 sriov-network-device-plugin 3.7.0-1",
"product": {
"name": "azl3 sriov-network-device-plugin 3.7.0-1",
"product_id": "18528"
}
}
],
"category": "product_name",
"name": "sriov-network-device-plugin"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccbl2 nmi 1.8.11-2",
"product": {
"name": "\u003ccbl2 nmi 1.8.11-2",
"product_id": "8"
}
},
{
"category": "product_version",
"name": "cbl2 nmi 1.8.11-2",
"product": {
"name": "cbl2 nmi 1.8.11-2",
"product_id": "20023"
}
},
{
"category": "product_version_range",
"name": "\u003ccbl2 nmi 1.8.11-2",
"product": {
"name": "\u003ccbl2 nmi 1.8.11-2",
"product_id": "21"
}
},
{
"category": "product_version",
"name": "cbl2 nmi 1.8.11-2",
"product": {
"name": "cbl2 nmi 1.8.11-2",
"product_id": "18916"
}
},
{
"category": "product_version_range",
"name": "\u003ccbl2 nmi 1.8.17-1",
"product": {
"name": "\u003ccbl2 nmi 1.8.17-1",
"product_id": "27"
}
},
{
"category": "product_version",
"name": "cbl2 nmi 1.8.17-1",
"product": {
"name": "cbl2 nmi 1.8.17-1",
"product_id": "18524"
}
}
],
"category": "product_name",
"name": "nmi"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cazl3 moby-engine 20.10.25-3",
"product": {
"name": "\u003cazl3 moby-engine 20.10.25-3",
"product_id": "32"
}
},
{
"category": "product_version",
"name": "azl3 moby-engine 20.10.25-3",
"product": {
"name": "azl3 moby-engine 20.10.25-3",
"product_id": "17964"
}
},
{
"category": "product_version_range",
"name": "\u003cazl3 moby-engine 25.0.3-1",
"product": {
"name": "\u003cazl3 moby-engine 25.0.3-1",
"product_id": "33"
}
},
{
"category": "product_version",
"name": "azl3 moby-engine 25.0.3-1",
"product": {
"name": "azl3 moby-engine 25.0.3-1",
"product_id": "17814"
}
}
],
"category": "product_name",
"name": "moby-engine"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccbl2 golang 1.17.13-2",
"product": {
"name": "\u003ccbl2 golang 1.17.13-2",
"product_id": "15"
}
},
{
"category": "product_version",
"name": "cbl2 golang 1.17.13-2",
"product": {
"name": "cbl2 golang 1.17.13-2",
"product_id": "19778"
}
},
{
"category": "product_version_range",
"name": "\u003ccbl2 golang 1.18.8-7",
"product": {
"name": "\u003ccbl2 golang 1.18.8-7",
"product_id": "14"
}
},
{
"category": "product_version",
"name": "cbl2 golang 1.18.8-7",
"product": {
"name": "cbl2 golang 1.18.8-7",
"product_id": "19785"
}
},
{
"category": "product_version_range",
"name": "\u003ccm1 golang 1.18.8-2",
"product": {
"name": "\u003ccm1 golang 1.18.8-2",
"product_id": "28"
}
},
{
"category": "product_version",
"name": "cm1 golang 1.18.8-2",
"product": {
"name": "cm1 golang 1.18.8-2",
"product_id": "18523"
}
},
{
"category": "product_version_range",
"name": "\u003ccbl2 golang 1.21.6-1",
"product": {
"name": "\u003ccbl2 golang 1.21.6-1",
"product_id": "38"
}
},
{
"category": "product_version",
"name": "cbl2 golang 1.21.6-1",
"product": {
"name": "cbl2 golang 1.21.6-1",
"product_id": "17375"
}
},
{
"category": "product_version_range",
"name": "\u003cazl3 golang 1.17.13-2,1.18.8-2,1.21.6-1",
"product": {
"name": "\u003cazl3 golang 1.17.13-2,1.18.8-2,1.21.6-1",
"product_id": "22"
}
},
{
"category": "product_version",
"name": "azl3 golang 1.17.13-2,1.18.8-2,1.21.6-1",
"product": {
"name": "azl3 golang 1.17.13-2,1.18.8-2,1.21.6-1",
"product_id": "18529"
}
}
],
"category": "product_name",
"name": "golang"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccbl2 moby-cli 24.0.9-1",
"product": {
"name": "\u003ccbl2 moby-cli 24.0.9-1",
"product_id": "25"
}
},
{
"category": "product_version",
"name": "cbl2 moby-cli 24.0.9-1",
"product": {
"name": "cbl2 moby-cli 24.0.9-1",
"product_id": "18526"
}
},
{
"category": "product_version_range",
"name": "\u003ccbl2 moby-cli 20.10.27-5",
"product": {
"name": "\u003ccbl2 moby-cli 20.10.27-5",
"product_id": "13"
}
},
{
"category": "product_version",
"name": "cbl2 moby-cli 20.10.27-5",
"product": {
"name": "cbl2 moby-cli 20.10.27-5",
"product_id": "19790"
}
}
],
"category": "product_name",
"name": "moby-cli"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccbl2 gh 2.13.0-2",
"product": {
"name": "\u003ccbl2 gh 2.13.0-2",
"product_id": "24"
}
},
{
"category": "product_version",
"name": "cbl2 gh 2.13.0-2",
"product": {
"name": "cbl2 gh 2.13.0-2",
"product_id": "18527"
}
}
],
"category": "product_name",
"name": "gh"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccbl2 containerized-data-importer 1.55.0-20",
"product": {
"name": "\u003ccbl2 containerized-data-importer 1.55.0-20",
"product_id": "37"
}
},
{
"category": "product_version",
"name": "cbl2 containerized-data-importer 1.55.0-20",
"product": {
"name": "cbl2 containerized-data-importer 1.55.0-20",
"product_id": "17401"
}
},
{
"category": "product_version_range",
"name": "\u003ccbl2 containerized-data-importer 1.55.0-23",
"product": {
"name": "\u003ccbl2 containerized-data-importer 1.55.0-23",
"product_id": "12"
}
},
{
"category": "product_version",
"name": "cbl2 containerized-data-importer 1.55.0-23",
"product": {
"name": "cbl2 containerized-data-importer 1.55.0-23",
"product_id": "19821"
}
}
],
"category": "product_name",
"name": "containerized-data-importer"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccbl2 azcopy 10.24.0-1",
"product": {
"name": "\u003ccbl2 azcopy 10.24.0-1",
"product_id": "35"
}
},
{
"category": "product_version",
"name": "cbl2 azcopy 10.24.0-1",
"product": {
"name": "cbl2 azcopy 10.24.0-1",
"product_id": "17426"
}
},
{
"category": "product_version_range",
"name": "\u003ccbl2 azcopy 10.15.0-15",
"product": {
"name": "\u003ccbl2 azcopy 10.15.0-15",
"product_id": "6"
}
},
{
"category": "product_version",
"name": "cbl2 azcopy 10.15.0-15",
"product": {
"name": "cbl2 azcopy 10.15.0-15",
"product_id": "20110"
}
}
],
"category": "product_name",
"name": "azcopy"
},
{
"category": "product_name",
"name": "cbl2 csi-driver-lvm 0.4.1-17",
"product": {
"name": "cbl2 csi-driver-lvm 0.4.1-17",
"product_id": "4"
}
},
{
"category": "product_name",
"name": "cbl2 jx 3.2.236-21",
"product": {
"name": "cbl2 jx 3.2.236-21",
"product_id": "18"
}
},
{
"category": "product_name",
"name": "cbl2 prometheus-adapter 0.10.0-17",
"product": {
"name": "cbl2 prometheus-adapter 0.10.0-17",
"product_id": "9"
}
},
{
"category": "product_name",
"name": "cbl2 terraform 1.3.2-25",
"product": {
"name": "cbl2 terraform 1.3.2-25",
"product_id": "10"
}
},
{
"category": "product_name",
"name": "azl3 gcc 13.2.0-7",
"product": {
"name": "azl3 gcc 13.2.0-7",
"product_id": "29"
}
},
{
"category": "product_name",
"name": "cbl2 tensorflow 2.11.1-2",
"product": {
"name": "cbl2 tensorflow 2.11.1-2",
"product_id": "20"
}
},
{
"category": "product_name",
"name": "azl3 tensorflow 2.16.1-9",
"product": {
"name": "azl3 tensorflow 2.16.1-9",
"product_id": "34"
}
},
{
"category": "product_name",
"name": "cbl2 cri-o 1.21.7-3",
"product": {
"name": "cbl2 cri-o 1.21.7-3",
"product_id": "11"
}
},
{
"category": "product_name",
"name": "cbl2 terraform 1.3.2-25",
"product": {
"name": "cbl2 terraform 1.3.2-25",
"product_id": "30"
}
},
{
"category": "product_name",
"name": "cbl2 influx-cli 2.6.1-17",
"product": {
"name": "cbl2 influx-cli 2.6.1-17",
"product_id": "1"
}
},
{
"category": "product_name",
"name": "cbl2 msft-golang 1.24.1-2",
"product": {
"name": "cbl2 msft-golang 1.24.1-2",
"product_id": "16"
}
},
{
"category": "product_name",
"name": "azl3 python-tensorboard 2.16.2-6",
"product": {
"name": "azl3 python-tensorboard 2.16.2-6",
"product_id": "19"
}
},
{
"category": "product_name",
"name": "azl3 golang 1.24.3-1",
"product": {
"name": "azl3 golang 1.24.3-1",
"product_id": "17"
}
}
],
"category": "vendor",
"name": "Microsoft"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 csi-driver-lvm 0.4.1-17 as a component of CBL Mariner 2.0",
"product_id": "17086-4"
},
"product_reference": "4",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 jx 3.2.236-21 as a component of CBL Mariner 2.0",
"product_id": "17086-18"
},
"product_reference": "18",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 prometheus 2.37.0-15 as a component of CBL Mariner 2.0",
"product_id": "17086-2"
},
"product_reference": "2",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 prometheus 2.37.0-15 as a component of CBL Mariner 2.0",
"product_id": "20327-17086"
},
"product_reference": "20327",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 prometheus-adapter 0.10.0-17 as a component of CBL Mariner 2.0",
"product_id": "17086-9"
},
"product_reference": "9",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 sriov-network-device-plugin 3.5.1-3 as a component of CBL Mariner 2.0",
"product_id": "17086-3"
},
"product_reference": "3",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 sriov-network-device-plugin 3.5.1-3 as a component of CBL Mariner 2.0",
"product_id": "20308-17086"
},
"product_reference": "20308",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 terraform 1.3.2-25 as a component of CBL Mariner 2.0",
"product_id": "17086-10"
},
"product_reference": "10",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 nmi 1.8.11-2 as a component of CBL Mariner 2.0",
"product_id": "17086-8"
},
"product_reference": "8",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 nmi 1.8.11-2 as a component of CBL Mariner 2.0",
"product_id": "20023-17086"
},
"product_reference": "20023",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 gcc 13.2.0-7 as a component of Azure Linux 3.0",
"product_id": "17084-29"
},
"product_reference": "29",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003cazl3 moby-engine 20.10.25-3 as a component of Azure Linux 3.0",
"product_id": "17084-32"
},
"product_reference": "32",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 moby-engine 20.10.25-3 as a component of Azure Linux 3.0",
"product_id": "17964-17084"
},
"product_reference": "17964",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003cazl3 prometheus 2.37.0-11 as a component of Azure Linux 3.0",
"product_id": "17084-7"
},
"product_reference": "7",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 prometheus 2.37.0-11 as a component of Azure Linux 3.0",
"product_id": "20094-17084"
},
"product_reference": "20094",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003cazl3 sriov-network-device-plugin 3.5.1-3 as a component of Azure Linux 3.0",
"product_id": "17084-5"
},
"product_reference": "5",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 sriov-network-device-plugin 3.5.1-3 as a component of Azure Linux 3.0",
"product_id": "20235-17084"
},
"product_reference": "20235",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 golang 1.17.13-2 as a component of CBL Mariner 2.0",
"product_id": "17086-15"
},
"product_reference": "15",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 golang 1.17.13-2 as a component of CBL Mariner 2.0",
"product_id": "19778-17086"
},
"product_reference": "19778",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 golang 1.18.8-7 as a component of CBL Mariner 2.0",
"product_id": "17086-14"
},
"product_reference": "14",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 golang 1.18.8-7 as a component of CBL Mariner 2.0",
"product_id": "19785-17086"
},
"product_reference": "19785",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 tensorflow 2.11.1-2 as a component of CBL Mariner 2.0",
"product_id": "17086-20"
},
"product_reference": "20",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 tensorflow 2.16.1-9 as a component of Azure Linux 3.0",
"product_id": "17084-34"
},
"product_reference": "34",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 cri-o 1.21.7-3 as a component of CBL Mariner 2.0",
"product_id": "17086-11"
},
"product_reference": "11",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 terraform 1.3.2-25 as a component of CBL Mariner 2.0",
"product_id": "17086-30"
},
"product_reference": "30",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 nmi 1.8.11-2 as a component of CBL Mariner 2.0",
"product_id": "17086-21"
},
"product_reference": "21",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 nmi 1.8.11-2 as a component of CBL Mariner 2.0",
"product_id": "18916-17086"
},
"product_reference": "18916",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccm1 golang 1.18.8-2 as a component of CBL Mariner 1.0",
"product_id": "16820-28"
},
"product_reference": "28",
"relates_to_product_reference": "16820"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cm1 golang 1.18.8-2 as a component of CBL Mariner 1.0",
"product_id": "18523-16820"
},
"product_reference": "18523",
"relates_to_product_reference": "16820"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 golang 1.21.6-1 as a component of CBL Mariner 2.0",
"product_id": "17086-38"
},
"product_reference": "38",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 golang 1.21.6-1 as a component of CBL Mariner 2.0",
"product_id": "17375-17086"
},
"product_reference": "17375",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 nmi 1.8.17-1 as a component of CBL Mariner 2.0",
"product_id": "17086-27"
},
"product_reference": "27",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 nmi 1.8.17-1 as a component of CBL Mariner 2.0",
"product_id": "18524-17086"
},
"product_reference": "18524",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 sriov-network-device-plugin 3.6.2-2 as a component of CBL Mariner 2.0",
"product_id": "17086-26"
},
"product_reference": "26",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 sriov-network-device-plugin 3.6.2-2 as a component of CBL Mariner 2.0",
"product_id": "18525-17086"
},
"product_reference": "18525",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 prometheus 2.37.9-1 as a component of CBL Mariner 2.0",
"product_id": "17086-36"
},
"product_reference": "36",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 prometheus 2.37.9-1 as a component of CBL Mariner 2.0",
"product_id": "17409-17086"
},
"product_reference": "17409",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 moby-cli 24.0.9-1 as a component of CBL Mariner 2.0",
"product_id": "17086-25"
},
"product_reference": "25",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 moby-cli 24.0.9-1 as a component of CBL Mariner 2.0",
"product_id": "18526-17086"
},
"product_reference": "18526",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 gh 2.13.0-2 as a component of CBL Mariner 2.0",
"product_id": "17086-24"
},
"product_reference": "24",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 gh 2.13.0-2 as a component of CBL Mariner 2.0",
"product_id": "18527-17086"
},
"product_reference": "18527",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 containerized-data-importer 1.55.0-20 as a component of CBL Mariner 2.0",
"product_id": "17086-37"
},
"product_reference": "37",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 containerized-data-importer 1.55.0-20 as a component of CBL Mariner 2.0",
"product_id": "17401-17086"
},
"product_reference": "17401",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 azcopy 10.24.0-1 as a component of CBL Mariner 2.0",
"product_id": "17086-35"
},
"product_reference": "35",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 azcopy 10.24.0-1 as a component of CBL Mariner 2.0",
"product_id": "17426-17086"
},
"product_reference": "17426",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003cazl3 sriov-network-device-plugin 3.7.0-1 as a component of Azure Linux 3.0",
"product_id": "17084-23"
},
"product_reference": "23",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 sriov-network-device-plugin 3.7.0-1 as a component of Azure Linux 3.0",
"product_id": "18528-17084"
},
"product_reference": "18528",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003cazl3 prometheus 2.45.4-1 as a component of Azure Linux 3.0",
"product_id": "17084-31"
},
"product_reference": "31",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 prometheus 2.45.4-1 as a component of Azure Linux 3.0",
"product_id": "18125-17084"
},
"product_reference": "18125",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003cazl3 moby-engine 25.0.3-1 as a component of Azure Linux 3.0",
"product_id": "17084-33"
},
"product_reference": "33",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 moby-engine 25.0.3-1 as a component of Azure Linux 3.0",
"product_id": "17814-17084"
},
"product_reference": "17814",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003cazl3 golang 1.17.13-2,1.18.8-2,1.21.6-1 as a component of Azure Linux 3.0",
"product_id": "17084-22"
},
"product_reference": "22",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 golang 1.17.13-2,1.18.8-2,1.21.6-1 as a component of Azure Linux 3.0",
"product_id": "18529-17084"
},
"product_reference": "18529",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 azcopy 10.15.0-15 as a component of CBL Mariner 2.0",
"product_id": "17086-6"
},
"product_reference": "6",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 azcopy 10.15.0-15 as a component of CBL Mariner 2.0",
"product_id": "20110-17086"
},
"product_reference": "20110",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 containerized-data-importer 1.55.0-23 as a component of CBL Mariner 2.0",
"product_id": "17086-12"
},
"product_reference": "12",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 containerized-data-importer 1.55.0-23 as a component of CBL Mariner 2.0",
"product_id": "19821-17086"
},
"product_reference": "19821",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 influx-cli 2.6.1-17 as a component of CBL Mariner 2.0",
"product_id": "17086-1"
},
"product_reference": "1",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 moby-cli 20.10.27-5 as a component of CBL Mariner 2.0",
"product_id": "17086-13"
},
"product_reference": "13",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 moby-cli 20.10.27-5 as a component of CBL Mariner 2.0",
"product_id": "19790-17086"
},
"product_reference": "19790",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 msft-golang 1.24.1-2 as a component of CBL Mariner 2.0",
"product_id": "17086-16"
},
"product_reference": "16",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 python-tensorboard 2.16.2-6 as a component of Azure Linux 3.0",
"product_id": "17084-19"
},
"product_reference": "19",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 golang 1.24.3-1 as a component of Azure Linux 3.0",
"product_id": "17084-17"
},
"product_reference": "17",
"relates_to_product_reference": "17084"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-41717",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"flags": [
{
"label": "component_not_present",
"product_ids": [
"17086-4",
"17086-18",
"17086-9",
"17086-10",
"17084-29",
"17086-20",
"17084-34",
"17086-11",
"17086-30",
"17086-1",
"17086-16",
"17084-19",
"17084-17"
]
}
],
"notes": [
{
"category": "general",
"text": "Go",
"title": "Assigning CNA"
}
],
"product_status": {
"fixed": [
"20327-17086",
"20308-17086",
"20023-17086",
"17964-17084",
"20094-17084",
"20235-17084",
"19778-17086",
"19785-17086",
"18916-17086",
"18523-16820",
"17375-17086",
"18524-17086",
"18525-17086",
"17409-17086",
"18526-17086",
"18527-17086",
"17401-17086",
"17426-17086",
"18528-17084",
"18125-17084",
"17814-17084",
"18529-17084",
"20110-17086",
"19821-17086",
"19790-17086"
],
"known_affected": [
"17086-2",
"17086-3",
"17086-8",
"17084-32",
"17084-7",
"17084-5",
"17086-15",
"17086-14",
"17086-21",
"16820-28",
"17086-38",
"17086-27",
"17086-26",
"17086-36",
"17086-25",
"17086-24",
"17086-37",
"17086-35",
"17084-23",
"17084-31",
"17084-33",
"17084-22",
"17086-6",
"17086-12",
"17086-13"
],
"known_not_affected": [
"17086-4",
"17086-18",
"17086-9",
"17086-10",
"17084-29",
"17086-20",
"17084-34",
"17086-11",
"17086-30",
"17086-1",
"17086-16",
"17084-19",
"17084-17"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-41717 Excessive memory growth in net/http and golang.org/x/net/http2 - VEX",
"url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2022-41717.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "2.37.9-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-2",
"17086-36"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "3.6.2-2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-3",
"17086-26"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "1.8.17-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-8",
"17086-21",
"17086-27"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "25.0.3-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17084-32",
"17084-33"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "2.45.4-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17084-7",
"17084-31"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "3.7.0-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17084-5",
"17084-23"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "1.17.13-2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-15"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "1.18.8-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-14"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "1.18.8-2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"16820-28"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "1.21.6-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-38"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "24.0.9-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-25",
"17086-13"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "2.13.0-2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-24"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "1.55.0-20:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-37",
"17086-12"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "10.24.0-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-35",
"17086-6"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2022-12-13T00:00:00.000Z",
"details": "1.17.13-2,1.18.8-2,1.21.6-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17084-22"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalsScore": 0.0,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"17086-2",
"17086-3",
"17086-8",
"17084-32",
"17084-7",
"17084-5",
"17086-15",
"17086-14",
"17086-21",
"16820-28",
"17086-38",
"17086-27",
"17086-26",
"17086-36",
"17086-25",
"17086-24",
"17086-37",
"17086-35",
"17084-23",
"17084-31",
"17084-33",
"17084-22",
"17086-6",
"17086-12",
"17086-13"
]
}
],
"title": "Excessive memory growth in net/http and golang.org/x/net/http2"
}
]
}
OPENSUSE-SU-2024:12552-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
go1.18-1.18.9-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: go1.18-1.18.9-1.1 on GA media
Description of the patch: These are all security issues fixed in the go1.18-1.18.9-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2024-12552
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:go1.18-1.18.9-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-1.18.9-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-1.18.9-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-1.18.9-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:go1.18-1.18.9-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-1.18.9-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-1.18.9-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-1.18.9-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "go1.18-1.18.9-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the go1.18-1.18.9-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-12552",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_12552-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-41717 page",
"url": "https://www.suse.com/security/cve/CVE-2022-41717/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-41720 page",
"url": "https://www.suse.com/security/cve/CVE-2022-41720/"
}
],
"title": "go1.18-1.18.9-1.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:12552-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "go1.18-1.18.9-1.1.aarch64",
"product": {
"name": "go1.18-1.18.9-1.1.aarch64",
"product_id": "go1.18-1.18.9-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "go1.18-doc-1.18.9-1.1.aarch64",
"product": {
"name": "go1.18-doc-1.18.9-1.1.aarch64",
"product_id": "go1.18-doc-1.18.9-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "go1.18-race-1.18.9-1.1.aarch64",
"product": {
"name": "go1.18-race-1.18.9-1.1.aarch64",
"product_id": "go1.18-race-1.18.9-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "go1.18-1.18.9-1.1.ppc64le",
"product": {
"name": "go1.18-1.18.9-1.1.ppc64le",
"product_id": "go1.18-1.18.9-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "go1.18-doc-1.18.9-1.1.ppc64le",
"product": {
"name": "go1.18-doc-1.18.9-1.1.ppc64le",
"product_id": "go1.18-doc-1.18.9-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "go1.18-race-1.18.9-1.1.ppc64le",
"product": {
"name": "go1.18-race-1.18.9-1.1.ppc64le",
"product_id": "go1.18-race-1.18.9-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "go1.18-1.18.9-1.1.s390x",
"product": {
"name": "go1.18-1.18.9-1.1.s390x",
"product_id": "go1.18-1.18.9-1.1.s390x"
}
},
{
"category": "product_version",
"name": "go1.18-doc-1.18.9-1.1.s390x",
"product": {
"name": "go1.18-doc-1.18.9-1.1.s390x",
"product_id": "go1.18-doc-1.18.9-1.1.s390x"
}
},
{
"category": "product_version",
"name": "go1.18-race-1.18.9-1.1.s390x",
"product": {
"name": "go1.18-race-1.18.9-1.1.s390x",
"product_id": "go1.18-race-1.18.9-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "go1.18-1.18.9-1.1.x86_64",
"product": {
"name": "go1.18-1.18.9-1.1.x86_64",
"product_id": "go1.18-1.18.9-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "go1.18-doc-1.18.9-1.1.x86_64",
"product": {
"name": "go1.18-doc-1.18.9-1.1.x86_64",
"product_id": "go1.18-doc-1.18.9-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "go1.18-race-1.18.9-1.1.x86_64",
"product": {
"name": "go1.18-race-1.18.9-1.1.x86_64",
"product_id": "go1.18-race-1.18.9-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.18-1.18.9-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.18-1.18.9-1.1.aarch64"
},
"product_reference": "go1.18-1.18.9-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.18-1.18.9-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.18-1.18.9-1.1.ppc64le"
},
"product_reference": "go1.18-1.18.9-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.18-1.18.9-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.18-1.18.9-1.1.s390x"
},
"product_reference": "go1.18-1.18.9-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.18-1.18.9-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.18-1.18.9-1.1.x86_64"
},
"product_reference": "go1.18-1.18.9-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.18-doc-1.18.9-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.aarch64"
},
"product_reference": "go1.18-doc-1.18.9-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.18-doc-1.18.9-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.ppc64le"
},
"product_reference": "go1.18-doc-1.18.9-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.18-doc-1.18.9-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.s390x"
},
"product_reference": "go1.18-doc-1.18.9-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.18-doc-1.18.9-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.x86_64"
},
"product_reference": "go1.18-doc-1.18.9-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.18-race-1.18.9-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.aarch64"
},
"product_reference": "go1.18-race-1.18.9-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.18-race-1.18.9-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.ppc64le"
},
"product_reference": "go1.18-race-1.18.9-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.18-race-1.18.9-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.s390x"
},
"product_reference": "go1.18-race-1.18.9-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.18-race-1.18.9-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.x86_64"
},
"product_reference": "go1.18-race-1.18.9-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-41717",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-41717"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.x86_64",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.x86_64",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-41717",
"url": "https://www.suse.com/security/cve/CVE-2022-41717"
},
{
"category": "external",
"summary": "SUSE Bug 1206135 for CVE-2022-41717",
"url": "https://bugzilla.suse.com/1206135"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.x86_64",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.x86_64",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.x86_64",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.x86_64",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-41717"
},
{
"cve": "CVE-2022-41720",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-41720"
}
],
"notes": [
{
"category": "general",
"text": "On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS(\"C:/tmp\").Open(\"COM1\") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS(\"\") has changed. Previously, an empty root was treated equivalently to \"/\", so os.DirFS(\"\").Open(\"tmp\") would open the path \"/tmp\". This now returns an error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.x86_64",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.x86_64",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-41720",
"url": "https://www.suse.com/security/cve/CVE-2022-41720"
},
{
"category": "external",
"summary": "SUSE Bug 1206134 for CVE-2022-41720",
"url": "https://bugzilla.suse.com/1206134"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.x86_64",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.x86_64",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-1.18.9-1.1.x86_64",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-doc-1.18.9-1.1.x86_64",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.aarch64",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.ppc64le",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.s390x",
"openSUSE Tumbleweed:go1.18-race-1.18.9-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-41720"
}
]
}
OPENSUSE-SU-2024:12553-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
go1.19-1.19.4-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: go1.19-1.19.4-1.1 on GA media
Description of the patch: These are all security issues fixed in the go1.19-1.19.4-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2024-12553
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:go1.19-1.19.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-1.19.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-1.19.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-1.19.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:go1.19-1.19.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-1.19.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-1.19.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-1.19.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "go1.19-1.19.4-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the go1.19-1.19.4-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-12553",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_12553-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-41717 page",
"url": "https://www.suse.com/security/cve/CVE-2022-41717/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-41720 page",
"url": "https://www.suse.com/security/cve/CVE-2022-41720/"
}
],
"title": "go1.19-1.19.4-1.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:12553-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "go1.19-1.19.4-1.1.aarch64",
"product": {
"name": "go1.19-1.19.4-1.1.aarch64",
"product_id": "go1.19-1.19.4-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "go1.19-doc-1.19.4-1.1.aarch64",
"product": {
"name": "go1.19-doc-1.19.4-1.1.aarch64",
"product_id": "go1.19-doc-1.19.4-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "go1.19-race-1.19.4-1.1.aarch64",
"product": {
"name": "go1.19-race-1.19.4-1.1.aarch64",
"product_id": "go1.19-race-1.19.4-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "go1.19-1.19.4-1.1.ppc64le",
"product": {
"name": "go1.19-1.19.4-1.1.ppc64le",
"product_id": "go1.19-1.19.4-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "go1.19-doc-1.19.4-1.1.ppc64le",
"product": {
"name": "go1.19-doc-1.19.4-1.1.ppc64le",
"product_id": "go1.19-doc-1.19.4-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "go1.19-race-1.19.4-1.1.ppc64le",
"product": {
"name": "go1.19-race-1.19.4-1.1.ppc64le",
"product_id": "go1.19-race-1.19.4-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "go1.19-1.19.4-1.1.s390x",
"product": {
"name": "go1.19-1.19.4-1.1.s390x",
"product_id": "go1.19-1.19.4-1.1.s390x"
}
},
{
"category": "product_version",
"name": "go1.19-doc-1.19.4-1.1.s390x",
"product": {
"name": "go1.19-doc-1.19.4-1.1.s390x",
"product_id": "go1.19-doc-1.19.4-1.1.s390x"
}
},
{
"category": "product_version",
"name": "go1.19-race-1.19.4-1.1.s390x",
"product": {
"name": "go1.19-race-1.19.4-1.1.s390x",
"product_id": "go1.19-race-1.19.4-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "go1.19-1.19.4-1.1.x86_64",
"product": {
"name": "go1.19-1.19.4-1.1.x86_64",
"product_id": "go1.19-1.19.4-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "go1.19-doc-1.19.4-1.1.x86_64",
"product": {
"name": "go1.19-doc-1.19.4-1.1.x86_64",
"product_id": "go1.19-doc-1.19.4-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "go1.19-race-1.19.4-1.1.x86_64",
"product": {
"name": "go1.19-race-1.19.4-1.1.x86_64",
"product_id": "go1.19-race-1.19.4-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.19-1.19.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.19-1.19.4-1.1.aarch64"
},
"product_reference": "go1.19-1.19.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.19-1.19.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.19-1.19.4-1.1.ppc64le"
},
"product_reference": "go1.19-1.19.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.19-1.19.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.19-1.19.4-1.1.s390x"
},
"product_reference": "go1.19-1.19.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.19-1.19.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.19-1.19.4-1.1.x86_64"
},
"product_reference": "go1.19-1.19.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.19-doc-1.19.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.aarch64"
},
"product_reference": "go1.19-doc-1.19.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.19-doc-1.19.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.ppc64le"
},
"product_reference": "go1.19-doc-1.19.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.19-doc-1.19.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.s390x"
},
"product_reference": "go1.19-doc-1.19.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.19-doc-1.19.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.x86_64"
},
"product_reference": "go1.19-doc-1.19.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.19-race-1.19.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.aarch64"
},
"product_reference": "go1.19-race-1.19.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.19-race-1.19.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.ppc64le"
},
"product_reference": "go1.19-race-1.19.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.19-race-1.19.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.s390x"
},
"product_reference": "go1.19-race-1.19.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.19-race-1.19.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.x86_64"
},
"product_reference": "go1.19-race-1.19.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-41717",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-41717"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.x86_64",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.x86_64",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-41717",
"url": "https://www.suse.com/security/cve/CVE-2022-41717"
},
{
"category": "external",
"summary": "SUSE Bug 1206135 for CVE-2022-41717",
"url": "https://bugzilla.suse.com/1206135"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.x86_64",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.x86_64",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.x86_64",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.x86_64",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-41717"
},
{
"cve": "CVE-2022-41720",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-41720"
}
],
"notes": [
{
"category": "general",
"text": "On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS(\"C:/tmp\").Open(\"COM1\") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS(\"\") has changed. Previously, an empty root was treated equivalently to \"/\", so os.DirFS(\"\").Open(\"tmp\") would open the path \"/tmp\". This now returns an error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.x86_64",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.x86_64",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-41720",
"url": "https://www.suse.com/security/cve/CVE-2022-41720"
},
{
"category": "external",
"summary": "SUSE Bug 1206134 for CVE-2022-41720",
"url": "https://bugzilla.suse.com/1206134"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.x86_64",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.x86_64",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-1.19.4-1.1.x86_64",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-doc-1.19.4-1.1.x86_64",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.aarch64",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.ppc64le",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.s390x",
"openSUSE Tumbleweed:go1.19-race-1.19.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-41720"
}
]
}
OPENSUSE-SU-2024:12615-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
traefik-2.9.6-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: traefik-2.9.6-1.1 on GA media
Description of the patch: These are all security issues fixed in the traefik-2.9.6-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2024-12615
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "traefik-2.9.6-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the traefik-2.9.6-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-12615",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_12615-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-23469 page",
"url": "https://www.suse.com/security/cve/CVE-2022-23469/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-41717 page",
"url": "https://www.suse.com/security/cve/CVE-2022-41717/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-46153 page",
"url": "https://www.suse.com/security/cve/CVE-2022-46153/"
}
],
"title": "traefik-2.9.6-1.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:12615-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "traefik-2.9.6-1.1.aarch64",
"product": {
"name": "traefik-2.9.6-1.1.aarch64",
"product_id": "traefik-2.9.6-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "traefik-2.9.6-1.1.ppc64le",
"product": {
"name": "traefik-2.9.6-1.1.ppc64le",
"product_id": "traefik-2.9.6-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "traefik-2.9.6-1.1.s390x",
"product": {
"name": "traefik-2.9.6-1.1.s390x",
"product_id": "traefik-2.9.6-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "traefik-2.9.6-1.1.x86_64",
"product": {
"name": "traefik-2.9.6-1.1.x86_64",
"product_id": "traefik-2.9.6-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "traefik-2.9.6-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64"
},
"product_reference": "traefik-2.9.6-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "traefik-2.9.6-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le"
},
"product_reference": "traefik-2.9.6-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "traefik-2.9.6-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x"
},
"product_reference": "traefik-2.9.6-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "traefik-2.9.6-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64"
},
"product_reference": "traefik-2.9.6-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-23469",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-23469"
}
],
"notes": [
{
"category": "general",
"text": "Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain cases, if the log level is set to DEBUG, credentials provided using the Authorization header are displayed in the debug logs. Attackers must have access to a users logging system in order for credentials to be stolen. This issue has been addressed in version 2.9.6. Users are advised to upgrade. Users unable to upgrade may set the log level to `INFO`, `WARN`, or `ERROR`.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-23469",
"url": "https://www.suse.com/security/cve/CVE-2022-23469"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-23469"
},
{
"cve": "CVE-2022-41717",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-41717"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-41717",
"url": "https://www.suse.com/security/cve/CVE-2022-41717"
},
{
"category": "external",
"summary": "SUSE Bug 1206135 for CVE-2022-41717",
"url": "https://bugzilla.suse.com/1206135"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-41717"
},
{
"cve": "CVE-2022-46153",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-46153"
}
],
"notes": [
{
"category": "general",
"text": "Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential vulnerability in Traefik managing TLS connections. A router configured with a not well-formatted TLSOption is exposed with an empty TLSOption. For instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates. Users are advised to upgrade to version 2.9.6. Users unable to upgrade should check their logs to detect the error messages and fix your TLS options.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-46153",
"url": "https://www.suse.com/security/cve/CVE-2022-46153"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik-2.9.6-1.1.aarch64",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.ppc64le",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.s390x",
"openSUSE Tumbleweed:traefik-2.9.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-46153"
}
]
}
OPENSUSE-SU-2024:13225-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
velero-1.11.1-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: velero-1.11.1-1.1 on GA media
Description of the patch: These are all security issues fixed in the velero-1.11.1-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2024-13225
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:velero-1.11.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-1.11.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-1.11.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-1.11.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:velero-1.11.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-1.11.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-1.11.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-1.11.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "velero-1.11.1-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the velero-1.11.1-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-13225",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13225-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-27191 page",
"url": "https://www.suse.com/security/cve/CVE-2022-27191/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-41717 page",
"url": "https://www.suse.com/security/cve/CVE-2022-41717/"
}
],
"title": "velero-1.11.1-1.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:13225-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "velero-1.11.1-1.1.aarch64",
"product": {
"name": "velero-1.11.1-1.1.aarch64",
"product_id": "velero-1.11.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "velero-bash-completion-1.11.1-1.1.aarch64",
"product": {
"name": "velero-bash-completion-1.11.1-1.1.aarch64",
"product_id": "velero-bash-completion-1.11.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "velero-fish-completion-1.11.1-1.1.aarch64",
"product": {
"name": "velero-fish-completion-1.11.1-1.1.aarch64",
"product_id": "velero-fish-completion-1.11.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "velero-zsh-completion-1.11.1-1.1.aarch64",
"product": {
"name": "velero-zsh-completion-1.11.1-1.1.aarch64",
"product_id": "velero-zsh-completion-1.11.1-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "velero-1.11.1-1.1.ppc64le",
"product": {
"name": "velero-1.11.1-1.1.ppc64le",
"product_id": "velero-1.11.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "velero-bash-completion-1.11.1-1.1.ppc64le",
"product": {
"name": "velero-bash-completion-1.11.1-1.1.ppc64le",
"product_id": "velero-bash-completion-1.11.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "velero-fish-completion-1.11.1-1.1.ppc64le",
"product": {
"name": "velero-fish-completion-1.11.1-1.1.ppc64le",
"product_id": "velero-fish-completion-1.11.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "velero-zsh-completion-1.11.1-1.1.ppc64le",
"product": {
"name": "velero-zsh-completion-1.11.1-1.1.ppc64le",
"product_id": "velero-zsh-completion-1.11.1-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "velero-1.11.1-1.1.s390x",
"product": {
"name": "velero-1.11.1-1.1.s390x",
"product_id": "velero-1.11.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "velero-bash-completion-1.11.1-1.1.s390x",
"product": {
"name": "velero-bash-completion-1.11.1-1.1.s390x",
"product_id": "velero-bash-completion-1.11.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "velero-fish-completion-1.11.1-1.1.s390x",
"product": {
"name": "velero-fish-completion-1.11.1-1.1.s390x",
"product_id": "velero-fish-completion-1.11.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "velero-zsh-completion-1.11.1-1.1.s390x",
"product": {
"name": "velero-zsh-completion-1.11.1-1.1.s390x",
"product_id": "velero-zsh-completion-1.11.1-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "velero-1.11.1-1.1.x86_64",
"product": {
"name": "velero-1.11.1-1.1.x86_64",
"product_id": "velero-1.11.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "velero-bash-completion-1.11.1-1.1.x86_64",
"product": {
"name": "velero-bash-completion-1.11.1-1.1.x86_64",
"product_id": "velero-bash-completion-1.11.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "velero-fish-completion-1.11.1-1.1.x86_64",
"product": {
"name": "velero-fish-completion-1.11.1-1.1.x86_64",
"product_id": "velero-fish-completion-1.11.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "velero-zsh-completion-1.11.1-1.1.x86_64",
"product": {
"name": "velero-zsh-completion-1.11.1-1.1.x86_64",
"product_id": "velero-zsh-completion-1.11.1-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-1.11.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-1.11.1-1.1.aarch64"
},
"product_reference": "velero-1.11.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-1.11.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-1.11.1-1.1.ppc64le"
},
"product_reference": "velero-1.11.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-1.11.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-1.11.1-1.1.s390x"
},
"product_reference": "velero-1.11.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-1.11.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-1.11.1-1.1.x86_64"
},
"product_reference": "velero-1.11.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-bash-completion-1.11.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.aarch64"
},
"product_reference": "velero-bash-completion-1.11.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-bash-completion-1.11.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.ppc64le"
},
"product_reference": "velero-bash-completion-1.11.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-bash-completion-1.11.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.s390x"
},
"product_reference": "velero-bash-completion-1.11.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-bash-completion-1.11.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.x86_64"
},
"product_reference": "velero-bash-completion-1.11.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-fish-completion-1.11.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.aarch64"
},
"product_reference": "velero-fish-completion-1.11.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-fish-completion-1.11.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.ppc64le"
},
"product_reference": "velero-fish-completion-1.11.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-fish-completion-1.11.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.s390x"
},
"product_reference": "velero-fish-completion-1.11.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-fish-completion-1.11.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.x86_64"
},
"product_reference": "velero-fish-completion-1.11.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-zsh-completion-1.11.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.aarch64"
},
"product_reference": "velero-zsh-completion-1.11.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-zsh-completion-1.11.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.ppc64le"
},
"product_reference": "velero-zsh-completion-1.11.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-zsh-completion-1.11.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.s390x"
},
"product_reference": "velero-zsh-completion-1.11.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "velero-zsh-completion-1.11.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.x86_64"
},
"product_reference": "velero-zsh-completion-1.11.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-27191",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-27191"
}
],
"notes": [
{
"category": "general",
"text": "The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:velero-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-27191",
"url": "https://www.suse.com/security/cve/CVE-2022-27191"
},
{
"category": "external",
"summary": "SUSE Bug 1197284 for CVE-2022-27191",
"url": "https://bugzilla.suse.com/1197284"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:velero-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:velero-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-27191"
},
{
"cve": "CVE-2022-41717",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-41717"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:velero-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-41717",
"url": "https://www.suse.com/security/cve/CVE-2022-41717"
},
{
"category": "external",
"summary": "SUSE Bug 1206135 for CVE-2022-41717",
"url": "https://bugzilla.suse.com/1206135"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:velero-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:velero-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-bash-completion-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-fish-completion-1.11.1-1.1.x86_64",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.aarch64",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.ppc64le",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.s390x",
"openSUSE Tumbleweed:velero-zsh-completion-1.11.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-41717"
}
]
}
OPENSUSE-SU-2024:13299-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
kustomize-5.1.1-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: kustomize-5.1.1-1.1 on GA media
Description of the patch: These are all security issues fixed in the kustomize-5.1.1-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2024-13299
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:kustomize-5.1.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-5.1.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-5.1.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-5.1.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
5 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "kustomize-5.1.1-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the kustomize-5.1.1-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-13299",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13299-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-41717 page",
"url": "https://www.suse.com/security/cve/CVE-2022-41717/"
}
],
"title": "kustomize-5.1.1-1.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:13299-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kustomize-5.1.1-1.1.aarch64",
"product": {
"name": "kustomize-5.1.1-1.1.aarch64",
"product_id": "kustomize-5.1.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "kustomize-bash-completion-5.1.1-1.1.aarch64",
"product": {
"name": "kustomize-bash-completion-5.1.1-1.1.aarch64",
"product_id": "kustomize-bash-completion-5.1.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "kustomize-fish-completion-5.1.1-1.1.aarch64",
"product": {
"name": "kustomize-fish-completion-5.1.1-1.1.aarch64",
"product_id": "kustomize-fish-completion-5.1.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "kustomize-zsh-completion-5.1.1-1.1.aarch64",
"product": {
"name": "kustomize-zsh-completion-5.1.1-1.1.aarch64",
"product_id": "kustomize-zsh-completion-5.1.1-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "kustomize-5.1.1-1.1.ppc64le",
"product": {
"name": "kustomize-5.1.1-1.1.ppc64le",
"product_id": "kustomize-5.1.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "kustomize-bash-completion-5.1.1-1.1.ppc64le",
"product": {
"name": "kustomize-bash-completion-5.1.1-1.1.ppc64le",
"product_id": "kustomize-bash-completion-5.1.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "kustomize-fish-completion-5.1.1-1.1.ppc64le",
"product": {
"name": "kustomize-fish-completion-5.1.1-1.1.ppc64le",
"product_id": "kustomize-fish-completion-5.1.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "kustomize-zsh-completion-5.1.1-1.1.ppc64le",
"product": {
"name": "kustomize-zsh-completion-5.1.1-1.1.ppc64le",
"product_id": "kustomize-zsh-completion-5.1.1-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "kustomize-5.1.1-1.1.s390x",
"product": {
"name": "kustomize-5.1.1-1.1.s390x",
"product_id": "kustomize-5.1.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "kustomize-bash-completion-5.1.1-1.1.s390x",
"product": {
"name": "kustomize-bash-completion-5.1.1-1.1.s390x",
"product_id": "kustomize-bash-completion-5.1.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "kustomize-fish-completion-5.1.1-1.1.s390x",
"product": {
"name": "kustomize-fish-completion-5.1.1-1.1.s390x",
"product_id": "kustomize-fish-completion-5.1.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "kustomize-zsh-completion-5.1.1-1.1.s390x",
"product": {
"name": "kustomize-zsh-completion-5.1.1-1.1.s390x",
"product_id": "kustomize-zsh-completion-5.1.1-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kustomize-5.1.1-1.1.x86_64",
"product": {
"name": "kustomize-5.1.1-1.1.x86_64",
"product_id": "kustomize-5.1.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "kustomize-bash-completion-5.1.1-1.1.x86_64",
"product": {
"name": "kustomize-bash-completion-5.1.1-1.1.x86_64",
"product_id": "kustomize-bash-completion-5.1.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "kustomize-fish-completion-5.1.1-1.1.x86_64",
"product": {
"name": "kustomize-fish-completion-5.1.1-1.1.x86_64",
"product_id": "kustomize-fish-completion-5.1.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "kustomize-zsh-completion-5.1.1-1.1.x86_64",
"product": {
"name": "kustomize-zsh-completion-5.1.1-1.1.x86_64",
"product_id": "kustomize-zsh-completion-5.1.1-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-5.1.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-5.1.1-1.1.aarch64"
},
"product_reference": "kustomize-5.1.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-5.1.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-5.1.1-1.1.ppc64le"
},
"product_reference": "kustomize-5.1.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-5.1.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-5.1.1-1.1.s390x"
},
"product_reference": "kustomize-5.1.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-5.1.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-5.1.1-1.1.x86_64"
},
"product_reference": "kustomize-5.1.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-bash-completion-5.1.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.aarch64"
},
"product_reference": "kustomize-bash-completion-5.1.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-bash-completion-5.1.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.ppc64le"
},
"product_reference": "kustomize-bash-completion-5.1.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-bash-completion-5.1.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.s390x"
},
"product_reference": "kustomize-bash-completion-5.1.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-bash-completion-5.1.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.x86_64"
},
"product_reference": "kustomize-bash-completion-5.1.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-fish-completion-5.1.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.aarch64"
},
"product_reference": "kustomize-fish-completion-5.1.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-fish-completion-5.1.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.ppc64le"
},
"product_reference": "kustomize-fish-completion-5.1.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-fish-completion-5.1.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.s390x"
},
"product_reference": "kustomize-fish-completion-5.1.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-fish-completion-5.1.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.x86_64"
},
"product_reference": "kustomize-fish-completion-5.1.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-zsh-completion-5.1.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.aarch64"
},
"product_reference": "kustomize-zsh-completion-5.1.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-zsh-completion-5.1.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.ppc64le"
},
"product_reference": "kustomize-zsh-completion-5.1.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-zsh-completion-5.1.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.s390x"
},
"product_reference": "kustomize-zsh-completion-5.1.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kustomize-zsh-completion-5.1.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.x86_64"
},
"product_reference": "kustomize-zsh-completion-5.1.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-41717",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-41717"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kustomize-5.1.1-1.1.aarch64",
"openSUSE Tumbleweed:kustomize-5.1.1-1.1.ppc64le",
"openSUSE Tumbleweed:kustomize-5.1.1-1.1.s390x",
"openSUSE Tumbleweed:kustomize-5.1.1-1.1.x86_64",
"openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.aarch64",
"openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.ppc64le",
"openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.s390x",
"openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.x86_64",
"openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.aarch64",
"openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.ppc64le",
"openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.s390x",
"openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.x86_64",
"openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.aarch64",
"openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.ppc64le",
"openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.s390x",
"openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-41717",
"url": "https://www.suse.com/security/cve/CVE-2022-41717"
},
{
"category": "external",
"summary": "SUSE Bug 1206135 for CVE-2022-41717",
"url": "https://bugzilla.suse.com/1206135"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kustomize-5.1.1-1.1.aarch64",
"openSUSE Tumbleweed:kustomize-5.1.1-1.1.ppc64le",
"openSUSE Tumbleweed:kustomize-5.1.1-1.1.s390x",
"openSUSE Tumbleweed:kustomize-5.1.1-1.1.x86_64",
"openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.aarch64",
"openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.ppc64le",
"openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.s390x",
"openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.x86_64",
"openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.aarch64",
"openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.ppc64le",
"openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.s390x",
"openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.x86_64",
"openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.aarch64",
"openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.ppc64le",
"openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.s390x",
"openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kustomize-5.1.1-1.1.aarch64",
"openSUSE Tumbleweed:kustomize-5.1.1-1.1.ppc64le",
"openSUSE Tumbleweed:kustomize-5.1.1-1.1.s390x",
"openSUSE Tumbleweed:kustomize-5.1.1-1.1.x86_64",
"openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.aarch64",
"openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.ppc64le",
"openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.s390x",
"openSUSE Tumbleweed:kustomize-bash-completion-5.1.1-1.1.x86_64",
"openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.aarch64",
"openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.ppc64le",
"openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.s390x",
"openSUSE Tumbleweed:kustomize-fish-completion-5.1.1-1.1.x86_64",
"openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.aarch64",
"openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.ppc64le",
"openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.s390x",
"openSUSE Tumbleweed:kustomize-zsh-completion-5.1.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-41717"
}
]
}
OPENSUSE-SU-2024:14076-1
Vulnerability from csaf_opensuse - Published: 2024-06-24 00:00 - Updated: 2024-06-24 00:00Summary
traefik2-2.11.5-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: traefik2-2.11.5-1.1 on GA media
Description of the patch: These are all security issues fixed in the traefik2-2.11.5-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2024-14076
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.8 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.8 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
46 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "traefik2-2.11.5-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the traefik2-2.11.5-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-14076",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_14076-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-23469 page",
"url": "https://www.suse.com/security/cve/CVE-2022-23469/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-41717 page",
"url": "https://www.suse.com/security/cve/CVE-2022-41717/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-41724 page",
"url": "https://www.suse.com/security/cve/CVE-2022-41724/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-46153 page",
"url": "https://www.suse.com/security/cve/CVE-2022-46153/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-24534 page",
"url": "https://www.suse.com/security/cve/CVE-2023-24534/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-29013 page",
"url": "https://www.suse.com/security/cve/CVE-2023-29013/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-39325 page",
"url": "https://www.suse.com/security/cve/CVE-2023-39325/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-45283 page",
"url": "https://www.suse.com/security/cve/CVE-2023-45283/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-45284 page",
"url": "https://www.suse.com/security/cve/CVE-2023-45284/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-45288 page",
"url": "https://www.suse.com/security/cve/CVE-2023-45288/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-47106 page",
"url": "https://www.suse.com/security/cve/CVE-2023-47106/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-47124 page",
"url": "https://www.suse.com/security/cve/CVE-2023-47124/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-47633 page",
"url": "https://www.suse.com/security/cve/CVE-2023-47633/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-24788 page",
"url": "https://www.suse.com/security/cve/CVE-2024-24788/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-28869 page",
"url": "https://www.suse.com/security/cve/CVE-2024-28869/"
}
],
"title": "traefik2-2.11.5-1.1 on GA media",
"tracking": {
"current_release_date": "2024-06-24T00:00:00Z",
"generator": {
"date": "2024-06-24T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:14076-1",
"initial_release_date": "2024-06-24T00:00:00Z",
"revision_history": [
{
"date": "2024-06-24T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "traefik2-2.11.5-1.1.aarch64",
"product": {
"name": "traefik2-2.11.5-1.1.aarch64",
"product_id": "traefik2-2.11.5-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "traefik2-2.11.5-1.1.ppc64le",
"product": {
"name": "traefik2-2.11.5-1.1.ppc64le",
"product_id": "traefik2-2.11.5-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "traefik2-2.11.5-1.1.s390x",
"product": {
"name": "traefik2-2.11.5-1.1.s390x",
"product_id": "traefik2-2.11.5-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "traefik2-2.11.5-1.1.x86_64",
"product": {
"name": "traefik2-2.11.5-1.1.x86_64",
"product_id": "traefik2-2.11.5-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "traefik2-2.11.5-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64"
},
"product_reference": "traefik2-2.11.5-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "traefik2-2.11.5-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le"
},
"product_reference": "traefik2-2.11.5-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "traefik2-2.11.5-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x"
},
"product_reference": "traefik2-2.11.5-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "traefik2-2.11.5-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
},
"product_reference": "traefik2-2.11.5-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-23469",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-23469"
}
],
"notes": [
{
"category": "general",
"text": "Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain cases, if the log level is set to DEBUG, credentials provided using the Authorization header are displayed in the debug logs. Attackers must have access to a users logging system in order for credentials to be stolen. This issue has been addressed in version 2.9.6. Users are advised to upgrade. Users unable to upgrade may set the log level to `INFO`, `WARN`, or `ERROR`.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-23469",
"url": "https://www.suse.com/security/cve/CVE-2022-23469"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-23469"
},
{
"cve": "CVE-2022-41717",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-41717"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-41717",
"url": "https://www.suse.com/security/cve/CVE-2022-41717"
},
{
"category": "external",
"summary": "SUSE Bug 1206135 for CVE-2022-41717",
"url": "https://bugzilla.suse.com/1206135"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-41717"
},
{
"cve": "CVE-2022-41724",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-41724"
}
],
"notes": [
{
"category": "general",
"text": "Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth \u003e= RequestClientCert).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-41724",
"url": "https://www.suse.com/security/cve/CVE-2022-41724"
},
{
"category": "external",
"summary": "SUSE Bug 1208271 for CVE-2022-41724",
"url": "https://bugzilla.suse.com/1208271"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-41724"
},
{
"cve": "CVE-2022-46153",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-46153"
}
],
"notes": [
{
"category": "general",
"text": "Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential vulnerability in Traefik managing TLS connections. A router configured with a not well-formatted TLSOption is exposed with an empty TLSOption. For instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates. Users are advised to upgrade to version 2.9.6. Users unable to upgrade should check their logs to detect the error messages and fix your TLS options.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-46153",
"url": "https://www.suse.com/security/cve/CVE-2022-46153"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-46153"
},
{
"cve": "CVE-2023-24534",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-24534"
}
],
"notes": [
{
"category": "general",
"text": "HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-24534",
"url": "https://www.suse.com/security/cve/CVE-2023-24534"
},
{
"category": "external",
"summary": "SUSE Bug 1210127 for CVE-2023-24534",
"url": "https://bugzilla.suse.com/1210127"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2023-24534"
},
{
"cve": "CVE-2023-29013",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-29013"
}
],
"notes": [
{
"category": "general",
"text": "Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-29013",
"url": "https://www.suse.com/security/cve/CVE-2023-29013"
},
{
"category": "external",
"summary": "SUSE Bug 1210505 for CVE-2023-29013",
"url": "https://bugzilla.suse.com/1210505"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2023-29013"
},
{
"cve": "CVE-2023-39325",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-39325"
}
],
"notes": [
{
"category": "general",
"text": "A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-39325",
"url": "https://www.suse.com/security/cve/CVE-2023-39325"
},
{
"category": "external",
"summary": "SUSE Bug 1216109 for CVE-2023-39325",
"url": "https://bugzilla.suse.com/1216109"
},
{
"category": "external",
"summary": "SUSE Bug 1230323 for CVE-2023-39325",
"url": "https://bugzilla.suse.com/1230323"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2023-39325"
},
{
"cve": "CVE-2023-45283",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-45283"
}
],
"notes": [
{
"category": "general",
"text": "The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-45283",
"url": "https://www.suse.com/security/cve/CVE-2023-45283"
},
{
"category": "external",
"summary": "SUSE Bug 1216943 for CVE-2023-45283",
"url": "https://bugzilla.suse.com/1216943"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2023-45283"
},
{
"cve": "CVE-2023-45284",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-45284"
}
],
"notes": [
{
"category": "general",
"text": "On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-45284",
"url": "https://www.suse.com/security/cve/CVE-2023-45284"
},
{
"category": "external",
"summary": "SUSE Bug 1216944 for CVE-2023-45284",
"url": "https://bugzilla.suse.com/1216944"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2023-45284"
},
{
"cve": "CVE-2023-45288",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-45288"
}
],
"notes": [
{
"category": "general",
"text": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-45288",
"url": "https://www.suse.com/security/cve/CVE-2023-45288"
},
{
"category": "external",
"summary": "SUSE Bug 1221400 for CVE-2023-45288",
"url": "https://bugzilla.suse.com/1221400"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2023-45288"
},
{
"cve": "CVE-2023-47106",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-47106"
}
],
"notes": [
{
"category": "general",
"text": "Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-47106",
"url": "https://www.suse.com/security/cve/CVE-2023-47106"
},
{
"category": "external",
"summary": "SUSE Bug 1217804 for CVE-2023-47106",
"url": "https://bugzilla.suse.com/1217804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2023-47106"
},
{
"cve": "CVE-2023-47124",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-47124"
}
],
"notes": [
{
"category": "general",
"text": "Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let\u0027s Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HTTPChallenge` with the `TLSChallenge` or the `DNSChallenge`.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-47124",
"url": "https://www.suse.com/security/cve/CVE-2023-47124"
},
{
"category": "external",
"summary": "SUSE Bug 1217806 for CVE-2023-47124",
"url": "https://bugzilla.suse.com/1217806"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2023-47124"
},
{
"cve": "CVE-2023-47633",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-47633"
}
],
"notes": [
{
"category": "general",
"text": "Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-47633",
"url": "https://www.suse.com/security/cve/CVE-2023-47633"
},
{
"category": "external",
"summary": "SUSE Bug 1217807 for CVE-2023-47633",
"url": "https://bugzilla.suse.com/1217807"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2023-47633"
},
{
"cve": "CVE-2024-24788",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-24788"
}
],
"notes": [
{
"category": "general",
"text": "A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-24788",
"url": "https://www.suse.com/security/cve/CVE-2024-24788"
},
{
"category": "external",
"summary": "SUSE Bug 1224018 for CVE-2024-24788",
"url": "https://bugzilla.suse.com/1224018"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2024-24788"
},
{
"cve": "CVE-2024-28869",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-28869"
}
],
"notes": [
{
"category": "general",
"text": "Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the \"Content-length\" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.\n",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-28869",
"url": "https://www.suse.com/security/cve/CVE-2024-28869"
},
{
"category": "external",
"summary": "SUSE Bug 1222825 for CVE-2024-28869",
"url": "https://bugzilla.suse.com/1222825"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.aarch64",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.ppc64le",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.s390x",
"openSUSE Tumbleweed:traefik2-2.11.5-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2024-28869"
}
]
}
RHBA-2023:4275
Vulnerability from csaf_redhat - Published: 2023-08-10 15:37 - Updated: 2026-08-15 08:21Summary
Red Hat Bug Fix Advisory: Red Hat Quay v3.8.11 bug fix release
Severity
Important
Notes
Topic: Red Hat Quay 3.8.11 is now available with bug fixes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Quay 3.8.11
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown.
6.5 (Medium)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A vulnerability was found in the golang.org/x/text/language package. An attacker can craft an Accept-Language header which ParseAcceptLanguage will take significant time to parse. This issue leads to a denial of service, and can impact availability.
7.5 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the golang package. The JoinPath doesn't remove the ../ path components appended to a domain that is not terminated by a slash, possibly leading to a directory traversal attack.
7.5 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
5.3 (Medium)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of requests.
7.5 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Golang Go, where it is vulnerable to a denial of service caused when processing large TLS handshake records. By sending specially-crafted TLS handshake records, a remote, authenticated attacker can cause a denial of service condition.
7.5 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Go, where it is vulnerable to a denial of service caused by an excessive resource consumption flaw in the net/http and mime/multipart packages. By sending a specially-crafted request, a remote attacker can cause a denial of service.
7.5 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by memory exhaustion in the common function in HTTP and MIME header parsing. By sending a specially crafted request, a remote attacker can cause a denial of service.
7.5 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by an issue during multipart form parsing. By sending a specially crafted input, a remote attacker can consume large amounts of CPU and memory, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by an infinite loop due to integer overflow when calling any of the Parse functions. By sending a specially crafted input, a remote attacker can cause a denial of service.
7.5 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Golang Go. This flaw allows a remote attacker to execute arbitrary code on the system, caused by not properly considering backticks (`) as Javascript string delimiters. By sending a specially crafted request, an attacker execute arbitrary code on the system.
9.8 (Critical)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang where angle brackets (<>) were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in the CSS context unexpectedly closing, allowing for the injection of unexpected HMTL if executed with untrusted input.
7.3 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
8.1 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr={{.}}") executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into tags.
7.3 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
92 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.8.11 is now available with bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.8.11",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2023:4275",
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
},
{
"category": "external",
"summary": "PROJQUAY-5360",
"url": "https://issues.redhat.com/browse/PROJQUAY-5360"
},
{
"category": "external",
"summary": "PROJQUAY-5842",
"url": "https://issues.redhat.com/browse/PROJQUAY-5842"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_4275.json"
}
],
"title": "Red Hat Bug Fix Advisory: Red Hat Quay v3.8.11 bug fix release",
"tracking": {
"current_release_date": "2026-08-15T08:21:03+00:00",
"generator": {
"date": "2026-08-15T08:21:03+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHBA-2023:4275",
"initial_release_date": "2023-08-10T15:37:50+00:00",
"revision_history": [
{
"date": "2023-08-10T15:37:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2023-08-10T15:37:50+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-15T08:21:03+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Quay v3",
"product": {
"name": "Quay v3",
"product_id": "8Base-Quay-3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"product_id": "quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.8.11-3"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.8.11-3"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"product": {
"name": "quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"product_id": "quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.8.11-4"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.8.11-2"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"product": {
"name": "quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"product_id": "quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.8.11-3"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"product_id": "quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.8.11-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.8.11-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"product": {
"name": "quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"product_id": "quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.8.11-20"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"product": {
"name": "quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"product_id": "quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.8.11-3"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64",
"product": {
"name": "quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64",
"product_id": "quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.8.11-13"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64"
},
"product_reference": "quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64"
},
"product_reference": "quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64"
},
"product_reference": "quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64"
},
"product_reference": "quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
},
"product_reference": "quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64",
"relates_to_product_reference": "8Base-Quay-3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-27664",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2022-09-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2124669"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http: handle server errors after sending GOAWAY",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-27664"
},
{
"category": "external",
"summary": "RHBZ#2124669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124669"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-27664",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27664"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-27664",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27664"
},
{
"category": "external",
"summary": "https://go.dev/issue/54658",
"url": "https://go.dev/issue/54658"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ",
"url": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ"
}
],
"release_date": "2022-09-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http: handle server errors after sending GOAWAY"
},
{
"cve": "CVE-2022-32149",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2022-10-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2134010"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in the golang.org/x/text/language package. An attacker can craft an Accept-Language header which ParseAcceptLanguage will take significant time to parse. This issue leads to a denial of service, and can impact availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "After careful analysis of the vulnerability Redhat is choosing to keep the vulnerability severity as moderate,the vulnerability exists in the ParseAcceptLanguage function of the golang text/language package,when an attacker could craft an unusually large accept header and due to the parser taking quadratic time complexity to finish, firstly the attacker would have to find a way smuggle an input to the parser and even then this would simply not result in a crash of any kind but more of resource hang which while can be unpleasant,does not equate to any real world damage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-32149"
},
{
"category": "external",
"summary": "RHBZ#2134010",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134010"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-32149",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-32149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32149"
},
{
"category": "external",
"summary": "https://go.dev/issue/56152",
"url": "https://go.dev/issue/56152"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-dev/c/qfPIly0X7aU",
"url": "https://groups.google.com/g/golang-dev/c/qfPIly0X7aU"
}
],
"release_date": "2022-10-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags"
},
{
"cve": "CVE-2022-32190",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2022-09-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2124668"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the golang package. The JoinPath doesn\u0027t remove the ../ path components appended to a domain that is not terminated by a slash, possibly leading to a directory traversal attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: JoinPath does not strip relative path components in all circumstances",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The vulnerable functions, JoinPath and URL.JoinPath was introduced in upstream go1.19, whereas, RHEL ships go1.17 and go1.18 versions, which does not contain the vulnerable code. Hence, packages shipped with RHEL-8, RHEL-9 are not affected.\n\nAll Y stream releases of OpenShift Container Platform 4 run on RHEL-8 or RHEL-9, so OCP 4 is also not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-32190"
},
{
"category": "external",
"summary": "RHBZ#2124668",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124668"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-32190",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32190"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-32190",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32190"
},
{
"category": "external",
"summary": "https://go.dev/issue/54385",
"url": "https://go.dev/issue/54385"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ",
"url": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ"
}
],
"release_date": "2022-09-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/url: JoinPath does not strip relative path components in all circumstances"
},
{
"cve": "CVE-2022-41717",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2023-01-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2161274"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Within Red Hat OpenShift Container Platform, the grafana container is listed as will not fix. Since OCP 4.10, Grafana itself is not shipped and the Grafana web server is protected behind an OAuth proxy server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41717"
},
{
"category": "external",
"summary": "RHBZ#2161274",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161274"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41717",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41717"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717"
},
{
"category": "external",
"summary": "https://go.dev/cl/455635",
"url": "https://go.dev/cl/455635"
},
{
"category": "external",
"summary": "https://go.dev/cl/455717",
"url": "https://go.dev/cl/455717"
},
{
"category": "external",
"summary": "https://go.dev/issue/56350",
"url": "https://go.dev/issue/56350"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ",
"url": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2022-1144",
"url": "https://pkg.go.dev/vuln/GO-2022-1144"
}
],
"release_date": "2022-11-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests"
},
{
"acknowledgments": [
{
"names": [
"Philippe Antoine"
],
"organization": "Catena Cyber"
}
],
"cve": "CVE-2022-41723",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-03-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2178358"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Within OpenShift Container Platform, the maximum impact of this vulnerability is a denial of service against an individual container so the impact could not cascade across the entire infrastructure, this vulnerability is rated Moderate impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41723"
},
{
"category": "external",
"summary": "RHBZ#2178358",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178358"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41723",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41723"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41723",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41723"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-vvpx-j8f3-3w6h",
"url": "https://github.com/advisories/GHSA-vvpx-j8f3-3w6h"
},
{
"category": "external",
"summary": "https://go.dev/cl/468135",
"url": "https://go.dev/cl/468135"
},
{
"category": "external",
"summary": "https://go.dev/cl/468295",
"url": "https://go.dev/cl/468295"
},
{
"category": "external",
"summary": "https://go.dev/issue/57855",
"url": "https://go.dev/issue/57855"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E",
"url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2023-1571",
"url": "https://pkg.go.dev/vuln/GO-2023-1571"
},
{
"category": "external",
"summary": "https://vuln.go.dev/ID/GO-2023-1571.json",
"url": "https://vuln.go.dev/ID/GO-2023-1571.json"
}
],
"release_date": "2023-02-17T14:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding"
},
{
"cve": "CVE-2022-41724",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2178492"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Golang Go, where it is vulnerable to a denial of service caused when processing large TLS handshake records. By sending specially-crafted TLS handshake records, a remote, authenticated attacker can cause a denial of service condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: crypto/tls: large handshake records may cause panics",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The opportunity for a denial of service is limited to the golang runtime. In the case of the OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41724"
},
{
"category": "external",
"summary": "RHBZ#2178492",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178492"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41724",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41724"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41724",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41724"
},
{
"category": "external",
"summary": "https://go.dev/cl/468125",
"url": "https://go.dev/cl/468125"
},
{
"category": "external",
"summary": "https://go.dev/issue/58001",
"url": "https://go.dev/issue/58001"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E",
"url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2023-1570",
"url": "https://pkg.go.dev/vuln/GO-2023-1570"
}
],
"release_date": "2023-02-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: crypto/tls: large handshake records may cause panics"
},
{
"cve": "CVE-2022-41725",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-03-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2178488"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go, where it is vulnerable to a denial of service caused by an excessive resource consumption flaw in the net/http and mime/multipart packages. By sending a specially-crafted request, a remote attacker can cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http, mime/multipart: denial of service from excessive resource consumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The opportunity for a Denial of Service is limited to the golang runtime. In the case of the OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41725"
},
{
"category": "external",
"summary": "RHBZ#2178488",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178488"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41725",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41725"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41725",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41725"
},
{
"category": "external",
"summary": "https://go.dev/cl/468124",
"url": "https://go.dev/cl/468124"
},
{
"category": "external",
"summary": "https://go.dev/issue/58006",
"url": "https://go.dev/issue/58006"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E",
"url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2023-1569",
"url": "https://pkg.go.dev/vuln/GO-2023-1569"
}
],
"release_date": "2023-02-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http, mime/multipart: denial of service from excessive resource consumption"
},
{
"cve": "CVE-2023-24534",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-04-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2184483"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by memory exhaustion in the common function in HTTP and MIME header parsing. By sending a specially crafted request, a remote attacker can cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http, net/textproto: denial of service from excessive memory allocation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-24534"
},
{
"category": "external",
"summary": "RHBZ#2184483",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184483"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-24534",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24534"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24534",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24534"
},
{
"category": "external",
"summary": "https://go.dev/issue/58975",
"url": "https://go.dev/issue/58975"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8",
"url": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8"
}
],
"release_date": "2023-04-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http, net/textproto: denial of service from excessive memory allocation"
},
{
"cve": "CVE-2023-24536",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-04-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2184482"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by an issue during multipart form parsing. By sending a specially crafted input, a remote attacker can consume large amounts of CPU and memory, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "For Red Hat Enterprise Linux,\n\n* Conmon uses Go in unit testing, but not functionally in the package. Go is used only in test files, hence, not in the actual code, thus, conmon is not-affected.\n* The CVE refers to multipart form parsing routine mime/multipart.Reader.ReadForm, which is not used in Grafana, hence it is not-affected.\n* Butane does not parse multipart forms, hence, it is also not-affected.\nRedhat has marked this vulnerability as moderate as this vulnerability could lead to a potential denial of service when all the resource of a system is consumed which is technically not a clear case of denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-24536"
},
{
"category": "external",
"summary": "RHBZ#2184482",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184482"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-24536",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24536"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24536",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24536"
},
{
"category": "external",
"summary": "https://go.dev/issue/59153",
"url": "https://go.dev/issue/59153"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8",
"url": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8"
}
],
"release_date": "2023-04-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption"
},
{
"cve": "CVE-2023-24537",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2023-04-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2184484"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by an infinite loop due to integer overflow when calling any of the Parse functions. By sending a specially crafted input, a remote attacker can cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: go/parser: Infinite loop in parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has been rated Moderate because it allows denial of service condition in Go\u2019s source code parser when processing specially crafted input containing //line directives with excessively large line numbers. Exploitation can cause the parser to enter an infinite loop, consuming CPU resources and rendering services unresponsive. While this issue does not permit code execution or data access, it poses a significant availability impact for systems processing untrusted Go source input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-24537"
},
{
"category": "external",
"summary": "RHBZ#2184484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-24537",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24537"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24537",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24537"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/59180",
"url": "https://github.com/golang/go/issues/59180"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8",
"url": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8"
}
],
"release_date": "2023-04-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
},
{
"category": "workaround",
"details": "To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: go/parser: Infinite loop in parsing"
},
{
"cve": "CVE-2023-24538",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2023-04-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2184481"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Golang Go. This flaw allows a remote attacker to execute arbitrary code on the system, caused by not properly considering backticks (`) as Javascript string delimiters. By sending a specially crafted request, an attacker execute arbitrary code on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: html/template: backticks not treated as string delimiters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The described issue involving Go templates and JavaScript template literals poses a moderate severity rather than an important one due to several mitigating factors. Firstly, the vulnerability requires specific conditions to be met: the presence of Go templates within JavaScript template literals. This limits the scope of affected codebases, reducing the likelihood of exploitation. Additionally, the decision to disallow such interactions in future releases of Go indicates a proactive approach to addressing the issue. Furthermore, the affected packages or components within Red Hat Enterprise Linux, such as Conmon, Grafana, and the RHC package, have been assessed and determined not to be impacted due to their specific usage patterns. So the limited scope of affected systems and the absence of exploitation vectors in specific components within Red Hat Enterprise Linux contribute to categorizing the severity of the issue as moderate.\n\nFor Red Hat Enterprise Linux,\n\n* Conmon uses go in unit testing, but not functionally in the package. Go is used only in test files, hence, not in the actual code, thus, conmon is not affected.\n* The Go templates in Grafana do not contain any javascript. Thus, it is not affected.\n* The rhc package do not make use of html/template. Hence, it is also not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-24538"
},
{
"category": "external",
"summary": "RHBZ#2184481",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184481"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-24538",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24538"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24538",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24538"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/59234",
"url": "https://github.com/golang/go/issues/59234"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8",
"url": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8"
}
],
"release_date": "2023-04-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: html/template: backticks not treated as string delimiters"
},
{
"acknowledgments": [
{
"names": [
"Juho Nurminen"
],
"organization": "Mattermost"
}
],
"cve": "CVE-2023-24539",
"cwe": {
"id": "CWE-176",
"name": "Improper Handling of Unicode Encoding"
},
"discovery_date": "2023-05-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2196026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang where angle brackets (\u003c\u003e) were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a \u0027/\u0027 character could result in the CSS context unexpectedly closing, allowing for the injection of unexpected HMTL if executed with untrusted input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: html/template: improper sanitization of CSS values",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "For Red Hat Enterprise Linux,\n\n* Conmon uses go in unit testing, but not functionally in the package. Go is used only in test files, not in the actual code. Thus, conmon is not affected.\n* The Go templates in Grafana do not contain any javascript. Thus, it is not affected.\n* Ignition does not make use of html/template.\n\nIn Red Hat Advanced Cluster Management for Kubernetes (RHACM), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable golang html/templates to authenticated users only, therefore, the impact is low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-24539"
},
{
"category": "external",
"summary": "RHBZ#2196026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-24539",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24539"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24539",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24539"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/59720",
"url": "https://github.com/golang/go/issues/59720"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU",
"url": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU"
}
],
"release_date": "2023-04-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: html/template: improper sanitization of CSS values"
},
{
"acknowledgments": [
{
"names": [
"Juho Nurminen"
],
"organization": "Mattermost"
}
],
"cve": "CVE-2023-24540",
"cwe": {
"id": "CWE-176",
"name": "Improper Handling of Unicode Encoding"
},
"discovery_date": "2023-05-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2196027"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set \"\\t\\n\\f\\r\\u0020\\u2028\\u2029\" in JavaScript contexts that also contain actions may not be properly sanitized during execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: html/template: improper handling of JavaScript whitespace",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "For Red Hat Enterprise Linux,\n* Conmon uses go in unit testing, but not functionally in the package. Go is used only in test files, hence, not in the actual code, thus, conmon is not affected.\n* The Go templates in Grafana do not contain any javascript. Thus, it is not affected.\n* Ignition does not make use of html/template.\n\nIn Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable golang html/templates to authenticated users only, therefore the impact is low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-24540"
},
{
"category": "external",
"summary": "RHBZ#2196027",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196027"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-24540",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24540"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24540",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24540"
},
{
"category": "external",
"summary": "https://go.dev/issue/59721",
"url": "https://go.dev/issue/59721"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU",
"url": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU"
}
],
"release_date": "2023-04-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: html/template: improper handling of JavaScript whitespace"
},
{
"acknowledgments": [
{
"names": [
"Juho Nurminen"
],
"organization": "Mattermost"
}
],
"cve": "CVE-2023-29400",
"cwe": {
"id": "CWE-176",
"name": "Improper Handling of Unicode Encoding"
},
"discovery_date": "2023-05-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2196029"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, \"attr={{.}}\") executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into tags.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: html/template: improper handling of empty HTML attributes",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "For Red Hat Enterprise Linux,\n\n* Conmon uses go in unit testing, but not functionally in the package. Go is used only in test files, not in the actual code. Thus, conmon is not affected.\n* The Go templates in Grafana do not contain any javascript. Thus, it is not affected.\n* Ignition does not make use of html/template.\n\nIn OpenShift Container Platform and Red Hat Advanced Cluster Management for Kubernetes (RHACM), the affected containers are behind OAuth authentication. This restricts access to the vulnerable golang html/templates to authenticated users, reducing the impact to low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-29400"
},
{
"category": "external",
"summary": "RHBZ#2196029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196029"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-29400",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29400"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-29400",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29400"
},
{
"category": "external",
"summary": "https://go.dev/issue/59722",
"url": "https://go.dev/issue/59722"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU",
"url": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU"
}
],
"release_date": "2023-04-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-08-10T15:37:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:4275"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: html/template: improper handling of empty HTML attributes"
}
]
}
RHEA-2023:3352
Vulnerability from csaf_redhat - Published: 2023-05-30 15:37 - Updated: 2026-08-12 21:25Summary
Red Hat Enhancement Advisory: OpenShift Virtualization 4.11.4 Images
Severity
Moderate
Notes
Topic: Red Hat OpenShift Virtualization release 4.11.4 is now available with updates to packages and images that fix several bugs and add enhancements.
Details: OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.
This advisory contains OpenShift Virtualization 4.11.4 images.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
5.3 (Medium)
Affected products
Fixed
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/checkup-framework@sha256:2bcd239de1b16eb64ea314dbfe4c965ed2ff6681b092423146ce1f9fba5dbd8d_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/hostpath-csi-driver-rhel8@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/hostpath-csi-driver@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/kubevirt-console-plugin@sha256:83bf9af49dc07256b50e13ad0ecc7cd9880b7c40e2b2061bbe125c0e9d9e2e6e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm@sha256:90ecca3593937aff5be9df15281bc785db64389268fbe38f6740c0dfbc53dc23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-copy-template@sha256:bb438a4542cbfed7e678dac1572ec5638b9b37fb0e5e2c95da975991dd4f05e6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:1c5393262a8eb9d449f2e803ba992429ca28d35d82813c43f1e2ae9cb62e11d7_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:7f287881ac2622d448495589ce866afa23e8938af5a62c0a055076275b8a6361_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize@sha256:48b8fe110deab5d921ac15dd554aee80cc971205c6fdd09169e64572fa6f4b50_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:0253e34b988af03f387c5531646996e94c6d3c06ad8bdc03ade5343570254337_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template@sha256:e99341b0b59811648d4e4ae44a47359cc3c588a2f8da0bfa75d68f3e8568ede1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:ffd5c41704e6dbdf7ba4dc5128f0f9896f31ab41994924b7db957d211113aef5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:471824fc8548ce1530b1490df4c51bda7228b10bd9f63ac1b596e9a8a565479e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-CNV-4.11:container-native-virtualization/vm-network-latency-checkup@sha256:3730fa5da224ed4ebaa44e7e1fa694a15c8469e6b318a6d9136f17d9158252a5_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
19 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Virtualization release 4.11.4 is now available with updates to packages and images that fix several bugs and add enhancements.",
"title": "Topic"
},
{
"category": "general",
"text": "OpenShift Virtualization is Red Hat\u0027s virtualization solution designed for Red Hat OpenShift Container Platform.\n\nThis advisory contains OpenShift Virtualization 4.11.4 images.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHEA-2023:3352",
"url": "https://access.redhat.com/errata/RHEA-2023:3352"
},
{
"category": "external",
"summary": "2078545",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2078545"
},
{
"category": "external",
"summary": "2091976",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2091976"
},
{
"category": "external",
"summary": "2152534",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2152534"
},
{
"category": "external",
"summary": "2167509",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2167509"
},
{
"category": "external",
"summary": "2169272",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2169272"
},
{
"category": "external",
"summary": "2176032",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2176032"
},
{
"category": "external",
"summary": "2176787",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2176787"
},
{
"category": "external",
"summary": "2189460",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2189460"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhea-2023_3352.json"
}
],
"title": "Red Hat Enhancement Advisory: OpenShift Virtualization 4.11.4 Images",
"tracking": {
"current_release_date": "2026-08-12T21:25:27+00:00",
"generator": {
"date": "2026-08-12T21:25:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.14"
}
},
"id": "RHEA-2023:3352",
"initial_release_date": "2023-05-30T15:37:37+00:00",
"revision_history": [
{
"date": "2023-05-30T15:37:37+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2023-05-30T15:37:37+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-12T21:25:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "CNV 4.11 for RHEL 8",
"product": {
"name": "CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:container_native_virtualization:4.11::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "container-native-virtualization/checkup-framework@sha256:2bcd239de1b16eb64ea314dbfe4c965ed2ff6681b092423146ce1f9fba5dbd8d_amd64",
"product": {
"name": "container-native-virtualization/checkup-framework@sha256:2bcd239de1b16eb64ea314dbfe4c965ed2ff6681b092423146ce1f9fba5dbd8d_amd64",
"product_id": "container-native-virtualization/checkup-framework@sha256:2bcd239de1b16eb64ea314dbfe4c965ed2ff6681b092423146ce1f9fba5dbd8d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/checkup-framework@sha256:2bcd239de1b16eb64ea314dbfe4c965ed2ff6681b092423146ce1f9fba5dbd8d?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/checkup-framework\u0026tag=v4.11.4-7"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/hostpath-csi-driver-rhel8@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"product": {
"name": "container-native-virtualization/hostpath-csi-driver-rhel8@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"product_id": "container-native-virtualization/hostpath-csi-driver-rhel8@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"product_identification_helper": {
"purl": "pkg:oci/hostpath-csi-driver-rhel8@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/hostpath-csi-driver-rhel8\u0026tag=v4.11.4-8"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/hostpath-csi-driver@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"product": {
"name": "container-native-virtualization/hostpath-csi-driver@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"product_id": "container-native-virtualization/hostpath-csi-driver@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"product_identification_helper": {
"purl": "pkg:oci/hostpath-csi-driver@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/hostpath-csi-driver\u0026tag=v4.11.4-8"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-console-plugin@sha256:83bf9af49dc07256b50e13ad0ecc7cd9880b7c40e2b2061bbe125c0e9d9e2e6e_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-console-plugin@sha256:83bf9af49dc07256b50e13ad0ecc7cd9880b7c40e2b2061bbe125c0e9d9e2e6e_amd64",
"product_id": "container-native-virtualization/kubevirt-console-plugin@sha256:83bf9af49dc07256b50e13ad0ecc7cd9880b7c40e2b2061bbe125c0e9d9e2e6e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-console-plugin@sha256:83bf9af49dc07256b50e13ad0ecc7cd9880b7c40e2b2061bbe125c0e9d9e2e6e?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin\u0026tag=v4.11.4-16"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm@sha256:90ecca3593937aff5be9df15281bc785db64389268fbe38f6740c0dfbc53dc23_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm@sha256:90ecca3593937aff5be9df15281bc785db64389268fbe38f6740c0dfbc53dc23_amd64",
"product_id": "container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm@sha256:90ecca3593937aff5be9df15281bc785db64389268fbe38f6740c0dfbc53dc23_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-tekton-tasks-cleanup-vm@sha256:90ecca3593937aff5be9df15281bc785db64389268fbe38f6740c0dfbc53dc23?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm\u0026tag=v4.11.4-20"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-tekton-tasks-copy-template@sha256:bb438a4542cbfed7e678dac1572ec5638b9b37fb0e5e2c95da975991dd4f05e6_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-copy-template@sha256:bb438a4542cbfed7e678dac1572ec5638b9b37fb0e5e2c95da975991dd4f05e6_amd64",
"product_id": "container-native-virtualization/kubevirt-tekton-tasks-copy-template@sha256:bb438a4542cbfed7e678dac1572ec5638b9b37fb0e5e2c95da975991dd4f05e6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-tekton-tasks-copy-template@sha256:bb438a4542cbfed7e678dac1572ec5638b9b37fb0e5e2c95da975991dd4f05e6?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-tekton-tasks-copy-template\u0026tag=v4.11.4-20"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:1c5393262a8eb9d449f2e803ba992429ca28d35d82813c43f1e2ae9cb62e11d7_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:1c5393262a8eb9d449f2e803ba992429ca28d35d82813c43f1e2ae9cb62e11d7_amd64",
"product_id": "container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:1c5393262a8eb9d449f2e803ba992429ca28d35d82813c43f1e2ae9cb62e11d7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-tekton-tasks-create-datavolume@sha256:1c5393262a8eb9d449f2e803ba992429ca28d35d82813c43f1e2ae9cb62e11d7?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-tekton-tasks-create-datavolume\u0026tag=v4.11.4-20"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:7f287881ac2622d448495589ce866afa23e8938af5a62c0a055076275b8a6361_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:7f287881ac2622d448495589ce866afa23e8938af5a62c0a055076275b8a6361_amd64",
"product_id": "container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:7f287881ac2622d448495589ce866afa23e8938af5a62c0a055076275b8a6361_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-tekton-tasks-create-vm-from-template@sha256:7f287881ac2622d448495589ce866afa23e8938af5a62c0a055076275b8a6361?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template\u0026tag=v4.11.4-20"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize@sha256:48b8fe110deab5d921ac15dd554aee80cc971205c6fdd09169e64572fa6f4b50_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize@sha256:48b8fe110deab5d921ac15dd554aee80cc971205c6fdd09169e64572fa6f4b50_amd64",
"product_id": "container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize@sha256:48b8fe110deab5d921ac15dd554aee80cc971205c6fdd09169e64572fa6f4b50_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-tekton-tasks-disk-virt-customize@sha256:48b8fe110deab5d921ac15dd554aee80cc971205c6fdd09169e64572fa6f4b50?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize\u0026tag=v4.11.4-20"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:0253e34b988af03f387c5531646996e94c6d3c06ad8bdc03ade5343570254337_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:0253e34b988af03f387c5531646996e94c6d3c06ad8bdc03ade5343570254337_amd64",
"product_id": "container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:0253e34b988af03f387c5531646996e94c6d3c06ad8bdc03ade5343570254337_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:0253e34b988af03f387c5531646996e94c6d3c06ad8bdc03ade5343570254337?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep\u0026tag=v4.11.4-20"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template@sha256:e99341b0b59811648d4e4ae44a47359cc3c588a2f8da0bfa75d68f3e8568ede1_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template@sha256:e99341b0b59811648d4e4ae44a47359cc3c588a2f8da0bfa75d68f3e8568ede1_amd64",
"product_id": "container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template@sha256:e99341b0b59811648d4e4ae44a47359cc3c588a2f8da0bfa75d68f3e8568ede1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-tekton-tasks-modify-vm-template@sha256:e99341b0b59811648d4e4ae44a47359cc3c588a2f8da0bfa75d68f3e8568ede1?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template\u0026tag=v4.11.4-20"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:ffd5c41704e6dbdf7ba4dc5128f0f9896f31ab41994924b7db957d211113aef5_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:ffd5c41704e6dbdf7ba4dc5128f0f9896f31ab41994924b7db957d211113aef5_amd64",
"product_id": "container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:ffd5c41704e6dbdf7ba4dc5128f0f9896f31ab41994924b7db957d211113aef5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-tekton-tasks-operator@sha256:ffd5c41704e6dbdf7ba4dc5128f0f9896f31ab41994924b7db957d211113aef5?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-tekton-tasks-operator\u0026tag=v4.11.4-5"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:471824fc8548ce1530b1490df4c51bda7228b10bd9f63ac1b596e9a8a565479e_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:471824fc8548ce1530b1490df4c51bda7228b10bd9f63ac1b596e9a8a565479e_amd64",
"product_id": "container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:471824fc8548ce1530b1490df4c51bda7228b10bd9f63ac1b596e9a8a565479e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:471824fc8548ce1530b1490df4c51bda7228b10bd9f63ac1b596e9a8a565479e?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status\u0026tag=v4.11.4-20"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/vm-network-latency-checkup@sha256:3730fa5da224ed4ebaa44e7e1fa694a15c8469e6b318a6d9136f17d9158252a5_amd64",
"product": {
"name": "container-native-virtualization/vm-network-latency-checkup@sha256:3730fa5da224ed4ebaa44e7e1fa694a15c8469e6b318a6d9136f17d9158252a5_amd64",
"product_id": "container-native-virtualization/vm-network-latency-checkup@sha256:3730fa5da224ed4ebaa44e7e1fa694a15c8469e6b318a6d9136f17d9158252a5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/vm-network-latency-checkup@sha256:3730fa5da224ed4ebaa44e7e1fa694a15c8469e6b318a6d9136f17d9158252a5?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/vm-network-latency-checkup\u0026tag=v4.11.4-7"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/checkup-framework@sha256:2bcd239de1b16eb64ea314dbfe4c965ed2ff6681b092423146ce1f9fba5dbd8d_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/checkup-framework@sha256:2bcd239de1b16eb64ea314dbfe4c965ed2ff6681b092423146ce1f9fba5dbd8d_amd64"
},
"product_reference": "container-native-virtualization/checkup-framework@sha256:2bcd239de1b16eb64ea314dbfe4c965ed2ff6681b092423146ce1f9fba5dbd8d_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/hostpath-csi-driver-rhel8@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/hostpath-csi-driver-rhel8@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64"
},
"product_reference": "container-native-virtualization/hostpath-csi-driver-rhel8@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/hostpath-csi-driver@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/hostpath-csi-driver@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64"
},
"product_reference": "container-native-virtualization/hostpath-csi-driver@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-console-plugin@sha256:83bf9af49dc07256b50e13ad0ecc7cd9880b7c40e2b2061bbe125c0e9d9e2e6e_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/kubevirt-console-plugin@sha256:83bf9af49dc07256b50e13ad0ecc7cd9880b7c40e2b2061bbe125c0e9d9e2e6e_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-console-plugin@sha256:83bf9af49dc07256b50e13ad0ecc7cd9880b7c40e2b2061bbe125c0e9d9e2e6e_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm@sha256:90ecca3593937aff5be9df15281bc785db64389268fbe38f6740c0dfbc53dc23_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm@sha256:90ecca3593937aff5be9df15281bc785db64389268fbe38f6740c0dfbc53dc23_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm@sha256:90ecca3593937aff5be9df15281bc785db64389268fbe38f6740c0dfbc53dc23_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-copy-template@sha256:bb438a4542cbfed7e678dac1572ec5638b9b37fb0e5e2c95da975991dd4f05e6_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-copy-template@sha256:bb438a4542cbfed7e678dac1572ec5638b9b37fb0e5e2c95da975991dd4f05e6_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-tekton-tasks-copy-template@sha256:bb438a4542cbfed7e678dac1572ec5638b9b37fb0e5e2c95da975991dd4f05e6_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:1c5393262a8eb9d449f2e803ba992429ca28d35d82813c43f1e2ae9cb62e11d7_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:1c5393262a8eb9d449f2e803ba992429ca28d35d82813c43f1e2ae9cb62e11d7_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:1c5393262a8eb9d449f2e803ba992429ca28d35d82813c43f1e2ae9cb62e11d7_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:7f287881ac2622d448495589ce866afa23e8938af5a62c0a055076275b8a6361_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:7f287881ac2622d448495589ce866afa23e8938af5a62c0a055076275b8a6361_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:7f287881ac2622d448495589ce866afa23e8938af5a62c0a055076275b8a6361_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize@sha256:48b8fe110deab5d921ac15dd554aee80cc971205c6fdd09169e64572fa6f4b50_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize@sha256:48b8fe110deab5d921ac15dd554aee80cc971205c6fdd09169e64572fa6f4b50_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize@sha256:48b8fe110deab5d921ac15dd554aee80cc971205c6fdd09169e64572fa6f4b50_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:0253e34b988af03f387c5531646996e94c6d3c06ad8bdc03ade5343570254337_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:0253e34b988af03f387c5531646996e94c6d3c06ad8bdc03ade5343570254337_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:0253e34b988af03f387c5531646996e94c6d3c06ad8bdc03ade5343570254337_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template@sha256:e99341b0b59811648d4e4ae44a47359cc3c588a2f8da0bfa75d68f3e8568ede1_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template@sha256:e99341b0b59811648d4e4ae44a47359cc3c588a2f8da0bfa75d68f3e8568ede1_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template@sha256:e99341b0b59811648d4e4ae44a47359cc3c588a2f8da0bfa75d68f3e8568ede1_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:ffd5c41704e6dbdf7ba4dc5128f0f9896f31ab41994924b7db957d211113aef5_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:ffd5c41704e6dbdf7ba4dc5128f0f9896f31ab41994924b7db957d211113aef5_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:ffd5c41704e6dbdf7ba4dc5128f0f9896f31ab41994924b7db957d211113aef5_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:471824fc8548ce1530b1490df4c51bda7228b10bd9f63ac1b596e9a8a565479e_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:471824fc8548ce1530b1490df4c51bda7228b10bd9f63ac1b596e9a8a565479e_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:471824fc8548ce1530b1490df4c51bda7228b10bd9f63ac1b596e9a8a565479e_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/vm-network-latency-checkup@sha256:3730fa5da224ed4ebaa44e7e1fa694a15c8469e6b318a6d9136f17d9158252a5_amd64 as a component of CNV 4.11 for RHEL 8",
"product_id": "8Base-CNV-4.11:container-native-virtualization/vm-network-latency-checkup@sha256:3730fa5da224ed4ebaa44e7e1fa694a15c8469e6b318a6d9136f17d9158252a5_amd64"
},
"product_reference": "container-native-virtualization/vm-network-latency-checkup@sha256:3730fa5da224ed4ebaa44e7e1fa694a15c8469e6b318a6d9136f17d9158252a5_amd64",
"relates_to_product_reference": "8Base-CNV-4.11"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-41717",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2023-01-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2161274"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Within Red Hat OpenShift Container Platform, the grafana container is listed as will not fix. Since OCP 4.10, Grafana itself is not shipped and the Grafana web server is protected behind an OAuth proxy server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-CNV-4.11:container-native-virtualization/checkup-framework@sha256:2bcd239de1b16eb64ea314dbfe4c965ed2ff6681b092423146ce1f9fba5dbd8d_amd64",
"8Base-CNV-4.11:container-native-virtualization/hostpath-csi-driver-rhel8@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"8Base-CNV-4.11:container-native-virtualization/hostpath-csi-driver@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-console-plugin@sha256:83bf9af49dc07256b50e13ad0ecc7cd9880b7c40e2b2061bbe125c0e9d9e2e6e_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm@sha256:90ecca3593937aff5be9df15281bc785db64389268fbe38f6740c0dfbc53dc23_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-copy-template@sha256:bb438a4542cbfed7e678dac1572ec5638b9b37fb0e5e2c95da975991dd4f05e6_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:1c5393262a8eb9d449f2e803ba992429ca28d35d82813c43f1e2ae9cb62e11d7_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:7f287881ac2622d448495589ce866afa23e8938af5a62c0a055076275b8a6361_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize@sha256:48b8fe110deab5d921ac15dd554aee80cc971205c6fdd09169e64572fa6f4b50_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:0253e34b988af03f387c5531646996e94c6d3c06ad8bdc03ade5343570254337_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template@sha256:e99341b0b59811648d4e4ae44a47359cc3c588a2f8da0bfa75d68f3e8568ede1_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:ffd5c41704e6dbdf7ba4dc5128f0f9896f31ab41994924b7db957d211113aef5_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:471824fc8548ce1530b1490df4c51bda7228b10bd9f63ac1b596e9a8a565479e_amd64",
"8Base-CNV-4.11:container-native-virtualization/vm-network-latency-checkup@sha256:3730fa5da224ed4ebaa44e7e1fa694a15c8469e6b318a6d9136f17d9158252a5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41717"
},
{
"category": "external",
"summary": "RHBZ#2161274",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161274"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41717",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41717"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717"
},
{
"category": "external",
"summary": "https://go.dev/cl/455635",
"url": "https://go.dev/cl/455635"
},
{
"category": "external",
"summary": "https://go.dev/cl/455717",
"url": "https://go.dev/cl/455717"
},
{
"category": "external",
"summary": "https://go.dev/issue/56350",
"url": "https://go.dev/issue/56350"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ",
"url": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2022-1144",
"url": "https://pkg.go.dev/vuln/GO-2022-1144"
}
],
"release_date": "2022-11-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-05-30T15:37:37+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-CNV-4.11:container-native-virtualization/checkup-framework@sha256:2bcd239de1b16eb64ea314dbfe4c965ed2ff6681b092423146ce1f9fba5dbd8d_amd64",
"8Base-CNV-4.11:container-native-virtualization/hostpath-csi-driver-rhel8@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"8Base-CNV-4.11:container-native-virtualization/hostpath-csi-driver@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-console-plugin@sha256:83bf9af49dc07256b50e13ad0ecc7cd9880b7c40e2b2061bbe125c0e9d9e2e6e_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm@sha256:90ecca3593937aff5be9df15281bc785db64389268fbe38f6740c0dfbc53dc23_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-copy-template@sha256:bb438a4542cbfed7e678dac1572ec5638b9b37fb0e5e2c95da975991dd4f05e6_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:1c5393262a8eb9d449f2e803ba992429ca28d35d82813c43f1e2ae9cb62e11d7_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:7f287881ac2622d448495589ce866afa23e8938af5a62c0a055076275b8a6361_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize@sha256:48b8fe110deab5d921ac15dd554aee80cc971205c6fdd09169e64572fa6f4b50_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:0253e34b988af03f387c5531646996e94c6d3c06ad8bdc03ade5343570254337_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template@sha256:e99341b0b59811648d4e4ae44a47359cc3c588a2f8da0bfa75d68f3e8568ede1_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:ffd5c41704e6dbdf7ba4dc5128f0f9896f31ab41994924b7db957d211113aef5_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:471824fc8548ce1530b1490df4c51bda7228b10bd9f63ac1b596e9a8a565479e_amd64",
"8Base-CNV-4.11:container-native-virtualization/vm-network-latency-checkup@sha256:3730fa5da224ed4ebaa44e7e1fa694a15c8469e6b318a6d9136f17d9158252a5_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHEA-2023:3352"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"8Base-CNV-4.11:container-native-virtualization/checkup-framework@sha256:2bcd239de1b16eb64ea314dbfe4c965ed2ff6681b092423146ce1f9fba5dbd8d_amd64",
"8Base-CNV-4.11:container-native-virtualization/hostpath-csi-driver-rhel8@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"8Base-CNV-4.11:container-native-virtualization/hostpath-csi-driver@sha256:5eca89e6ac055a448b2e2150698c5fa2e66f8026a0a5da28defcea6c4376ecaa_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-console-plugin@sha256:83bf9af49dc07256b50e13ad0ecc7cd9880b7c40e2b2061bbe125c0e9d9e2e6e_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm@sha256:90ecca3593937aff5be9df15281bc785db64389268fbe38f6740c0dfbc53dc23_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-copy-template@sha256:bb438a4542cbfed7e678dac1572ec5638b9b37fb0e5e2c95da975991dd4f05e6_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:1c5393262a8eb9d449f2e803ba992429ca28d35d82813c43f1e2ae9cb62e11d7_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:7f287881ac2622d448495589ce866afa23e8938af5a62c0a055076275b8a6361_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize@sha256:48b8fe110deab5d921ac15dd554aee80cc971205c6fdd09169e64572fa6f4b50_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:0253e34b988af03f387c5531646996e94c6d3c06ad8bdc03ade5343570254337_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template@sha256:e99341b0b59811648d4e4ae44a47359cc3c588a2f8da0bfa75d68f3e8568ede1_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:ffd5c41704e6dbdf7ba4dc5128f0f9896f31ab41994924b7db957d211113aef5_amd64",
"8Base-CNV-4.11:container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:471824fc8548ce1530b1490df4c51bda7228b10bd9f63ac1b596e9a8a565479e_amd64",
"8Base-CNV-4.11:container-native-virtualization/vm-network-latency-checkup@sha256:3730fa5da224ed4ebaa44e7e1fa694a15c8469e6b318a6d9136f17d9158252a5_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests"
}
]
}
RHSA-2023:0328
Vulnerability from csaf_redhat - Published: 2023-01-23 15:26 - Updated: 2026-08-12 21:26Summary
Red Hat Security Advisory: go-toolset and golang security and bug fix update
Severity
Moderate
Notes
Topic: An update for go-toolset and golang is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
The golang packages provide the Go programming language compiler.
Security Fix(es):
* golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)
* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
* golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* Internal linking fails on ppc64le (BZ#2144547)
* crypto testcases fail on golang on s390x [rhel-9] (BZ#2149311)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw allows a maliciously crafted archive to cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panic.
6.5 (Medium)
Affected products
Fixed
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64 | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64 | — |
Threats
Impact
Moderate
A flaw was found in the golang package, where requests forwarded by reverse proxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This issue could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. After the fix, the reverse proxy sanitizes the query parameters in the forwarded query when the outbound request's form field is set after the reverse proxy. The director function returns, indicating that the proxy has parsed the query parameters. Proxies that do not parse query parameters continue to forward the original query parameters unchanged.
7.5 (High)
Affected products
Fixed
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64 | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64 | — |
Threats
Impact
Moderate
A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown.
6.5 (Medium)
Affected products
Fixed
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64 | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64 | — |
Threats
Impact
Moderate
An uncontrolled resource consumption flaw was found in Golang math/big. A too-short encoded message can cause a panic in Float.GobDecode and Rat.GobDecode in math/big in Go, potentially allowing an attacker to create a denial of service, impacting availability.
6.5 (Medium)
Affected products
Fixed
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src | — |
Workaround
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64 | — |
Workaround
|
Threats
Impact
Low
A flaw was found in the golang package, where programs that compile regular expressions from untrusted sources are vulnerable to memory exhaustion or a denial of service. The parsed regexp representation is linear in the input size. Still, in some cases, the constant factor can be as high as 40,000, making a relatively small regexp consume larger amounts of memory. After the fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Routine use of regular expressions is unaffected.
6.5 (Medium)
Affected products
Fixed
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64 | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64 | — |
Threats
Impact
Moderate
A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
5.3 (Medium)
Affected products
Fixed
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64 | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src | — | ||
| Unresolved product id: AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64 | — |
Threats
Impact
Moderate
References
45 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for go-toolset and golang is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.\n\nThe golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)\n\n* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)\n\n* golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Internal linking fails on ppc64le (BZ#2144547)\n\n* crypto testcases fail on golang on s390x [rhel-9] (BZ#2149311)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2023:0328",
"url": "https://access.redhat.com/errata/RHSA-2023:0328"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "2132867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132867"
},
{
"category": "external",
"summary": "2132868",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132868"
},
{
"category": "external",
"summary": "2132872",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132872"
},
{
"category": "external",
"summary": "2149311",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2149311"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0328.json"
}
],
"title": "Red Hat Security Advisory: go-toolset and golang security and bug fix update",
"tracking": {
"current_release_date": "2026-08-12T21:26:29+00:00",
"generator": {
"date": "2026-08-12T21:26:29+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.14"
}
},
"id": "RHSA-2023:0328",
"initial_release_date": "2023-01-23T15:26:30+00:00",
"revision_history": [
{
"date": "2023-01-23T15:26:30+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2023-01-23T15:26:30+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-12T21:26:29+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.18.9-1.el9_1.src",
"product": {
"name": "go-toolset-0:1.18.9-1.el9_1.src",
"product_id": "go-toolset-0:1.18.9-1.el9_1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.18.9-1.el9_1?arch=src"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.18.9-1.el9_1.src",
"product": {
"name": "golang-0:1.18.9-1.el9_1.src",
"product_id": "golang-0:1.18.9-1.el9_1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.18.9-1.el9_1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.18.9-1.el9_1.aarch64",
"product": {
"name": "go-toolset-0:1.18.9-1.el9_1.aarch64",
"product_id": "go-toolset-0:1.18.9-1.el9_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.18.9-1.el9_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.18.9-1.el9_1.aarch64",
"product": {
"name": "golang-0:1.18.9-1.el9_1.aarch64",
"product_id": "golang-0:1.18.9-1.el9_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.18.9-1.el9_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.18.9-1.el9_1.aarch64",
"product": {
"name": "golang-bin-0:1.18.9-1.el9_1.aarch64",
"product_id": "golang-bin-0:1.18.9-1.el9_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.18.9-1.el9_1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.18.9-1.el9_1.ppc64le",
"product": {
"name": "go-toolset-0:1.18.9-1.el9_1.ppc64le",
"product_id": "go-toolset-0:1.18.9-1.el9_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.18.9-1.el9_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.18.9-1.el9_1.ppc64le",
"product": {
"name": "golang-0:1.18.9-1.el9_1.ppc64le",
"product_id": "golang-0:1.18.9-1.el9_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.18.9-1.el9_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.18.9-1.el9_1.ppc64le",
"product": {
"name": "golang-bin-0:1.18.9-1.el9_1.ppc64le",
"product_id": "golang-bin-0:1.18.9-1.el9_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.18.9-1.el9_1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.18.9-1.el9_1.x86_64",
"product": {
"name": "go-toolset-0:1.18.9-1.el9_1.x86_64",
"product_id": "go-toolset-0:1.18.9-1.el9_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.18.9-1.el9_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.18.9-1.el9_1.x86_64",
"product": {
"name": "golang-0:1.18.9-1.el9_1.x86_64",
"product_id": "golang-0:1.18.9-1.el9_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.18.9-1.el9_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.18.9-1.el9_1.x86_64",
"product": {
"name": "golang-bin-0:1.18.9-1.el9_1.x86_64",
"product_id": "golang-bin-0:1.18.9-1.el9_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.18.9-1.el9_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.18.9-1.el9_1.x86_64",
"product": {
"name": "golang-race-0:1.18.9-1.el9_1.x86_64",
"product_id": "golang-race-0:1.18.9-1.el9_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.18.9-1.el9_1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.18.9-1.el9_1.s390x",
"product": {
"name": "go-toolset-0:1.18.9-1.el9_1.s390x",
"product_id": "go-toolset-0:1.18.9-1.el9_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.18.9-1.el9_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.18.9-1.el9_1.s390x",
"product": {
"name": "golang-0:1.18.9-1.el9_1.s390x",
"product_id": "golang-0:1.18.9-1.el9_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.18.9-1.el9_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.18.9-1.el9_1.s390x",
"product": {
"name": "golang-bin-0:1.18.9-1.el9_1.s390x",
"product_id": "golang-bin-0:1.18.9-1.el9_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.18.9-1.el9_1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-docs-0:1.18.9-1.el9_1.noarch",
"product": {
"name": "golang-docs-0:1.18.9-1.el9_1.noarch",
"product_id": "golang-docs-0:1.18.9-1.el9_1.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-docs@1.18.9-1.el9_1?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-misc-0:1.18.9-1.el9_1.noarch",
"product": {
"name": "golang-misc-0:1.18.9-1.el9_1.noarch",
"product_id": "golang-misc-0:1.18.9-1.el9_1.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-misc@1.18.9-1.el9_1?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-src-0:1.18.9-1.el9_1.noarch",
"product": {
"name": "golang-src-0:1.18.9-1.el9_1.noarch",
"product_id": "golang-src-0:1.18.9-1.el9_1.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-src@1.18.9-1.el9_1?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-tests-0:1.18.9-1.el9_1.noarch",
"product": {
"name": "golang-tests-0:1.18.9-1.el9_1.noarch",
"product_id": "golang-tests-0:1.18.9-1.el9_1.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-tests@1.18.9-1.el9_1?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.18.9-1.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64"
},
"product_reference": "go-toolset-0:1.18.9-1.el9_1.aarch64",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.18.9-1.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le"
},
"product_reference": "go-toolset-0:1.18.9-1.el9_1.ppc64le",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.18.9-1.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x"
},
"product_reference": "go-toolset-0:1.18.9-1.el9_1.s390x",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.18.9-1.el9_1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src"
},
"product_reference": "go-toolset-0:1.18.9-1.el9_1.src",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.18.9-1.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
},
"product_reference": "go-toolset-0:1.18.9-1.el9_1.x86_64",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.18.9-1.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64"
},
"product_reference": "golang-0:1.18.9-1.el9_1.aarch64",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.18.9-1.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le"
},
"product_reference": "golang-0:1.18.9-1.el9_1.ppc64le",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.18.9-1.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x"
},
"product_reference": "golang-0:1.18.9-1.el9_1.s390x",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.18.9-1.el9_1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src"
},
"product_reference": "golang-0:1.18.9-1.el9_1.src",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.18.9-1.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64"
},
"product_reference": "golang-0:1.18.9-1.el9_1.x86_64",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.18.9-1.el9_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64"
},
"product_reference": "golang-bin-0:1.18.9-1.el9_1.aarch64",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.18.9-1.el9_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le"
},
"product_reference": "golang-bin-0:1.18.9-1.el9_1.ppc64le",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.18.9-1.el9_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x"
},
"product_reference": "golang-bin-0:1.18.9-1.el9_1.s390x",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.18.9-1.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64"
},
"product_reference": "golang-bin-0:1.18.9-1.el9_1.x86_64",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-docs-0:1.18.9-1.el9_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch"
},
"product_reference": "golang-docs-0:1.18.9-1.el9_1.noarch",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-misc-0:1.18.9-1.el9_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch"
},
"product_reference": "golang-misc-0:1.18.9-1.el9_1.noarch",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.18.9-1.el9_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64"
},
"product_reference": "golang-race-0:1.18.9-1.el9_1.x86_64",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-src-0:1.18.9-1.el9_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch"
},
"product_reference": "golang-src-0:1.18.9-1.el9_1.noarch",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-tests-0:1.18.9-1.el9_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
},
"product_reference": "golang-tests-0:1.18.9-1.el9_1.noarch",
"relates_to_product_reference": "AppStream-9.1.0.Z.MAIN"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Adam Korczynski"
],
"organization": "ADA Logics"
},
{
"names": [
"OSS-Fuzz"
]
}
],
"cve": "CVE-2022-2879",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2022-10-07T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2132867"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw allows a maliciously crafted archive to cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.\n\n\nThis flaw additionally affects the github.com/vbatts/tar-split library and was fixed in v0.12.1.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
],
"known_not_affected": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-2879"
},
{
"category": "external",
"summary": "RHBZ#2132867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132867"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-2879",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2879"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2879",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2879"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/54853",
"url": "https://github.com/golang/go/issues/54853"
},
{
"category": "external",
"summary": "https://github.com/vbatts/tar-split/releases/tag/v0.12.1",
"url": "https://github.com/vbatts/tar-split/releases/tag/v0.12.1"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1",
"url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1"
}
],
"release_date": "2022-10-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-01-23T15:26:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:0328"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers"
},
{
"acknowledgments": [
{
"names": [
"Daniel Abeles"
],
"organization": "Head of Research, Oxeye"
},
{
"names": [
"Gal Goldstein"
],
"organization": "Security Researcher, Oxeye"
}
],
"cve": "CVE-2022-2880",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2022-10-07T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2132868"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the golang package, where requests forwarded by reverse proxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This issue could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. After the fix, the reverse proxy sanitizes the query parameters in the forwarded query when the outbound request\u0027s form field is set after the reverse proxy. The director function returns, indicating that the proxy has parsed the query parameters. Proxies that do not parse query parameters continue to forward the original query parameters unchanged.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The opportunity to exploit this vulnerability is limited to the Golang runtime. In the case of the OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
],
"known_not_affected": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-2880"
},
{
"category": "external",
"summary": "RHBZ#2132868",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132868"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-2880",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2880"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2880",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2880"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/54663",
"url": "https://github.com/golang/go/issues/54663"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1",
"url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1"
}
],
"release_date": "2022-10-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-01-23T15:26:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:0328"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters"
},
{
"cve": "CVE-2022-27664",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2022-09-06T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2124669"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http: handle server errors after sending GOAWAY",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
],
"known_not_affected": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-27664"
},
{
"category": "external",
"summary": "RHBZ#2124669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124669"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-27664",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27664"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-27664",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27664"
},
{
"category": "external",
"summary": "https://go.dev/issue/54658",
"url": "https://go.dev/issue/54658"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ",
"url": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ"
}
],
"release_date": "2022-09-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-01-23T15:26:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:0328"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http: handle server errors after sending GOAWAY"
},
{
"cve": "CVE-2022-32189",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2022-08-02T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2113814"
}
],
"notes": [
{
"category": "description",
"text": "An uncontrolled resource consumption flaw was found in Golang math/big. A too-short encoded message can cause a panic in Float.GobDecode and Rat.GobDecode in math/big in Go, potentially allowing an attacker to create a denial of service, impacting availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw stems from a particular and specific method (GoBDecode) which isn\u0027t commonly used. There are few components within Red Hat offerings which call this function. In rare cases where this method is called, the component limits possible damage or it is not possible to be triggered by an attacker. For these combined reasons the impact has been downgraded to Low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
],
"known_not_affected": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-32189"
},
{
"category": "external",
"summary": "RHBZ#2113814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2113814"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-32189",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32189"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-32189",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32189"
},
{
"category": "external",
"summary": "https://go.dev/issue/53871",
"url": "https://go.dev/issue/53871"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-nuts/c/DCFSyTGM0wU",
"url": "https://groups.google.com/g/golang-nuts/c/DCFSyTGM0wU"
}
],
"release_date": "2022-08-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-01-23T15:26:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:0328"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service"
},
{
"acknowledgments": [
{
"names": [
"Adam Korczynski"
],
"organization": "ADA Logics"
},
{
"names": [
"OSS-Fuzz"
]
}
],
"cve": "CVE-2022-41715",
"discovery_date": "2022-10-07T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2132872"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the golang package, where programs that compile regular expressions from untrusted sources are vulnerable to memory exhaustion or a denial of service. The parsed regexp representation is linear in the input size. Still, in some cases, the constant factor can be as high as 40,000, making a relatively small regexp consume larger amounts of memory. After the fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Routine use of regular expressions is unaffected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: regexp/syntax: limit memory used by parsing regexps",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
],
"known_not_affected": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41715"
},
{
"category": "external",
"summary": "RHBZ#2132872",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132872"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41715",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41715"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41715",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41715"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/55949",
"url": "https://github.com/golang/go/issues/55949"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1",
"url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1"
}
],
"release_date": "2022-10-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-01-23T15:26:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:0328"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: regexp/syntax: limit memory used by parsing regexps"
},
{
"cve": "CVE-2022-41717",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2023-01-16T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2161274"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Within Red Hat OpenShift Container Platform, the grafana container is listed as will not fix. Since OCP 4.10, Grafana itself is not shipped and the Grafana web server is protected behind an OAuth proxy server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
],
"known_not_affected": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-41717"
},
{
"category": "external",
"summary": "RHBZ#2161274",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161274"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-41717",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41717"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717"
},
{
"category": "external",
"summary": "https://go.dev/cl/455635",
"url": "https://go.dev/cl/455635"
},
{
"category": "external",
"summary": "https://go.dev/cl/455717",
"url": "https://go.dev/cl/455717"
},
{
"category": "external",
"summary": "https://go.dev/issue/56350",
"url": "https://go.dev/issue/56350"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ",
"url": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2022-1144",
"url": "https://pkg.go.dev/vuln/GO-2022-1144"
}
],
"release_date": "2022-11-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-01-23T15:26:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:0328"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:go-toolset-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.src",
"AppStream-9.1.0.Z.MAIN:golang-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.aarch64",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.ppc64le",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.s390x",
"AppStream-9.1.0.Z.MAIN:golang-bin-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-docs-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-misc-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-race-0:1.18.9-1.el9_1.x86_64",
"AppStream-9.1.0.Z.MAIN:golang-src-0:1.18.9-1.el9_1.noarch",
"AppStream-9.1.0.Z.MAIN:golang-tests-0:1.18.9-1.el9_1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…