DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
IBM Spectrum Protect: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2022-11-20
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift ausnutzen, um einen Cross site Scripting Angriff durchzuführen, Informationen offenzulegen oder einen Denial of Service zu verursachen.
01
beschreibt (13)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-32149US | high7.5 | — | ||
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. | ||||
| CVE-2022-32190US | high7.5 | — | ||
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", desp… | ||||
| CVE-2022-27664US | high7.5 | — | ||
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by… | ||||
| CVE-2022-32189US | high7.5 | — | ||
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service. | ||||
| CVE-2022-32148US | medium6.5OT erhöht | — | ||
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containin… | ||||
| CVE-2022-30635US | high7.5 | — | ||
Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains de… | ||||
| CVE-2022-30633US | high7.5 | — | ||
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document in… | ||||
| CVE-2022-30632US | high7.5 | — | ||
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of… | ||||
| CVE-2022-30631US | high7.5 | — | ||
Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large… | ||||
| CVE-2022-30630US | high7.5 | — | ||
Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path… | ||||
| CVE-2022-28131US | high7.5 | — | ||
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document. | ||||
| CVE-2022-1962US | medium5.5 | — | ||
Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or dec… | ||||
| CVE-2022-1705US | medium6.5 | — | ||
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2022:8626 vom 2022-11-29external
- WID-SEC-W-2022-2134 - CSAF Versionself
- WID-SEC-2022-2134 - Portal Versionself
- IBM Security Bulletin vom 2022-11-20external
- IBM Security Bulletin 6847643 vom 2022-12-20external
- IBM Security Bulletin 6847653 vom 2022-12-20external
- IBM Security Bulletin 7005589 vom 2023-06-21external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan