DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Red Hat OpenShift: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2022-06-13
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, einen nicht näher spezifizierten Angriff durchzuführen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.
01
beschreibt (10)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-31045US | critical9.8 | — | ||
Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memor… | ||||
| CVE-2022-29228US | high7.5 | — | ||
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitting a local response,… | ||||
| CVE-2022-29226US | critical9.1OT erhöht | — | ||
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design… | ||||
| CVE-2022-29225US | high7.5 | — | ||
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in th… | ||||
| CVE-2022-29224US | medium5.9 | — | ||
Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types… | ||||
| CVE-2022-1650US | critical9.3 | — | ||
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2. | ||||
| CVE-2022-28327US | high7.5 | — | ||
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input. | ||||
| CVE-2022-24675US | high7.5 | Exploit | ||
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. | ||||
| CVE-2022-24785US | high7.5 | Exploit | ||
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between v… | ||||
| CVE-2022-23806US | critical9.1 | — | ||
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory vom 2022-06-13external
- Red Hat Security Advisory RHSA-2022:5004 vom 2022-07-04external
- Red Hat Security Advisory vom 2022-06-13external
- Red Hat Security Advisory RHSA-2022:5030 vom 2022-06-14external
- Red Hat Security Advisory RHSA-2022:5068 vom 2022-08-10external
- Red Hat Security Advisory RHSA-2022:5201 vom 2022-06-28external
- Red Hat Security Advisory RHSA-2022:5337 vom 2022-07-01external
- Red Hat Security Advisory RHSA-2022:5392 vom 2022-06-28external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan