DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Red Hat OpenShift: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2022-04-07
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu verursachen und Sicherheitsmaßnahmen zu umgehen.
01
beschreibt (16)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-43565US | high7.5 | — | ||
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. | ||||
| CVE-2022-24726US | high7.5 | — | ||
Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing… | ||||
| CVE-2022-23606US | medium6.5 | — | ||
Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections establish… | ||||
| CVE-2022-21655US | high7.5 | — | ||
Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured wit… | ||||
| CVE-2022-21654US | critical9.8 | — | ||
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default… | ||||
| CVE-2021-43826US | high7.5 | — | ||
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <e… | ||||
| CVE-2021-43825US | high7.5 | — | ||
Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response dat… | ||||
| CVE-2021-43824US | high7.5 | — | ||
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT f… | ||||
| CVE-2022-23635US | high7.5 | — | ||
Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request processing error, allowin… | ||||
| CVE-2021-3749US | high7.5 | Exploit | ||
axios is vulnerable to Inefficient Regular Expression Complexity | ||||
| CVE-2021-36221US | medium5.9 | — | ||
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. | ||||
| CVE-2021-29923US | high7.5 | — | ||
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control t… | ||||
| CVE-2021-29482US | high7.5 | — | ||
xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a… | ||||
| CVE-2021-3121US | high8.6 | — | ||
An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue. | ||||
| CVE-2020-28852US | high7.5 | — | ||
In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to… | ||||
| CVE-2020-28851US | high7.5 | — | ||
In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HT… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory vom 2022-04-07external
- Red Hat Security Advisory vom 2022-04-07external
- Red Hat Security Advisory RHSA-2022:1679 vom 2022-05-10external
- Red Hat Security Advisory RHSA-2022:4668 vom 2022-05-19external
- Red Hat Security Advisory RHSA-2022:7129 vom 2022-10-25external
- Red Hat Security Advisory RHSA-2022:7457 vom 2022-11-08external
- Red Hat Security Advisory RHSA-2022:7954 vom 2022-11-15external
- Red Hat Security Advisory RHSA-2024:2944 vom 2024-05-21external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan