DeutschShown in its original language — a full translation is planned for a future version.
IBM Spectrum Protect: Mehrere Schwachstellen
view advisory published 2022-11-20
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift ausnutzen, um einen Cross site Scripting Angriff durchzuführen, Informationen offenzulegen oder einen Denial of Service zu verursachen.
01
describes (13)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-32149US | high7.5 | — | ||
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. | ||||
| CVE-2022-32190US | high7.5 | — | ||
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", desp… | ||||
| CVE-2022-27664US | high7.5 | — | ||
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by… | ||||
| CVE-2022-32189US | high7.5 | — | ||
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service. | ||||
| CVE-2022-32148US | medium6.5OT elevated | — | ||
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containin… | ||||
| CVE-2022-30635US | high7.5 | — | ||
Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains de… | ||||
| CVE-2022-30633US | high7.5 | — | ||
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document in… | ||||
| CVE-2022-30632US | high7.5 | — | ||
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of… | ||||
| CVE-2022-30631US | high7.5 | — | ||
Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large… | ||||
| CVE-2022-30630US | high7.5 | — | ||
Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path… | ||||
| CVE-2022-28131US | high7.5 | — | ||
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document. | ||||
| CVE-2022-1962US | medium5.5 | — | ||
Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or dec… | ||||
| CVE-2022-1705US | medium6.5 | — | ||
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2022:8626 vom 2022-11-29external
- WID-SEC-W-2022-2134 - CSAF Versionself
- WID-SEC-2022-2134 - Portal Versionself
- IBM Security Bulletin vom 2022-11-20external
- IBM Security Bulletin 6847643 vom 2022-12-20external
- IBM Security Bulletin 6847653 vom 2022-12-20external
- IBM Security Bulletin 7005589 vom 2023-06-21external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan