DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Red Hat OpenShift: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-01-25
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um beliebigen Programmcode auszuführen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (18)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-38561US | high7.5 | — | ||
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing un… | ||||
| CVE-2022-1798US | medium6.5 | — | ||
A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesy… | ||||
| CVE-2022-32148US | medium6.5OT erhöht | — | ||
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containin… | ||||
| CVE-2022-30635US | high7.5 | — | ||
Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains de… | ||||
| CVE-2022-30633US | high7.5 | — | ||
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document in… | ||||
| CVE-2022-30632US | high7.5 | — | ||
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of… | ||||
| CVE-2022-30631US | high7.5 | — | ||
Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large… | ||||
| CVE-2022-30630US | high7.5 | — | ||
Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path… | ||||
| CVE-2022-30629US | low3.1OT erhöht | — | ||
Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive conn… | ||||
| CVE-2022-28131US | high7.5 | — | ||
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document. | ||||
| CVE-2022-1962US | medium5.5 | — | ||
Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or dec… | ||||
| CVE-2022-1705US | medium6.5 | — | ||
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate… | ||||
| CVE-2022-29526US | medium5.3 | — | ||
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a f… | ||||
| CVE-2022-23806US | critical9.1 | — | ||
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element. | ||||
| CVE-2022-23773US | high7.5 | Exploit | ||
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is… | ||||
| CVE-2022-23772US | high7.5 | — | ||
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. | ||||
| CVE-2021-44717US | medium4.8 | — | ||
Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file desc… | ||||
| CVE-2021-44716US | high7.5 | — | ||
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2023:0408 vom 2023-01-25external
- Red Hat Security Advisory RHSA-2023:0566 vom 2023-02-07external
- Red Hat Security Advisory RHSA-2023:0652 vom 2023-02-15external
- Red Hat Security Advisory RHSA-2023:0769 vom 2023-02-21external
- Red Hat Security Advisory RHSA-2023:0774 vom 2023-02-22external
- Red Hat Security Advisory RHSA-2023:0890 vom 2023-02-28external
- Red Hat Security Advisory RHSA-2023:0895 vom 2023-02-28external
- Red Hat Security Advisory RHSA-2023:1042 vom 2023-03-07external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan