DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Red Hat Migration Toolkit for Containers: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-02-08
Ein entfernter, anonymer oder angemeldeter Angreifer kann mehrere Schwachstellen in Red Hat Migration Toolkit for Containers ausnutzen, um seine Rechte zu erweitern, einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.
01
beschreibt (9)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-41717US | medium5.3 | Exploit | ||
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the… | ||||
| CVE-2022-41715US | high7.5OT erhöht | — | ||
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the siz… | ||||
| CVE-2022-32149US | high7.5 | — | ||
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. | ||||
| CVE-2022-2880US | high7.5 | — | ||
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query paramete… | ||||
| CVE-2022-2879US | high7.5 | — | ||
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing re… | ||||
| CVE-2022-32190US | high7.5 | — | ||
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", desp… | ||||
| CVE-2022-27664US | high7.5 | — | ||
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by… | ||||
| CVE-2022-32189US | high7.5 | — | ||
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service. | ||||
| CVE-2021-43138US | high7.8 | — | ||
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2023:0632 vom 2023-02-15external
- RedHat Security Advisory vom 2023-02-08external
- Red Hat Security Advisory RHSA-2023:0728 vom 2023-02-17external
- Red Hat Security Advisory RHSA-2023:0769 vom 2023-02-21external
- Red Hat Security Advisory RHSA-2023:0774 vom 2023-02-22external
- Red Hat Security Advisory RHSA-2023:2041 vom 2023-04-27external
- Red Hat Security Advisory RHSA-2023:3645 vom 2023-06-16external
- Red Hat Security Advisory RHSA-2023:5006 vom 2023-12-30external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan