DeutschShown in its original language — a full translation is planned for a future version.
Red Hat OpenShift: Mehrere Schwachstellen
view advisory published 2022-06-13
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, einen nicht näher spezifizierten Angriff durchzuführen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-31045US | critical9.8 | — | ||
Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memor… | ||||
| CVE-2022-29228US | high7.5 | — | ||
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitting a local response,… | ||||
| CVE-2022-29226US | critical9.1OT elevated | — | ||
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design… | ||||
| CVE-2022-29225US | high7.5 | — | ||
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in th… | ||||
| CVE-2022-29224US | medium5.9 | — | ||
Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types… | ||||
| CVE-2022-1650US | critical9.3 | — | ||
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2. | ||||
| CVE-2022-28327US | high7.5 | — | ||
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input. | ||||
| CVE-2022-24675US | high7.5 | Exploit | ||
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. | ||||
| CVE-2022-24785US | high7.5 | Exploit | ||
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between v… | ||||
| CVE-2022-23806US | critical9.1 | — | ||
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element. | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory vom 2022-06-13external
- Red Hat Security Advisory RHSA-2022:5004 vom 2022-07-04external
- Red Hat Security Advisory vom 2022-06-13external
- Red Hat Security Advisory RHSA-2022:5030 vom 2022-06-14external
- Red Hat Security Advisory RHSA-2022:5068 vom 2022-08-10external
- Red Hat Security Advisory RHSA-2022:5201 vom 2022-06-28external
- Red Hat Security Advisory RHSA-2022:5337 vom 2022-07-01external
- Red Hat Security Advisory RHSA-2022:5392 vom 2022-06-28external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan