what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2022-6188-01

Red Hat Security Advisory 2022-6188-01
Posted Aug 26, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-6188-01 - This is an updated release of the Node Maintenance Operator. The Node Maintenance Operator cordons off nodes from the rest of the cluster and drains all the pods from the nodes. By placing nodes under maintenance, administrators can proactively power down nodes, move workloads to other parts of the cluster, and ensure that workloads do not get interrupted.

tags | advisory
systems | linux, redhat
advisories | CVE-2022-1292, CVE-2022-1586, CVE-2022-1705, CVE-2022-1962, CVE-2022-2068, CVE-2022-2097, CVE-2022-28131, CVE-2022-30630, CVE-2022-30631, CVE-2022-30632, CVE-2022-30633, CVE-2022-32148
SHA-256 | 8f2aa8b81657dc6b4634729c008fff6204973bf554d196175f117636caf6ff15

Red Hat Security Advisory 2022-6188-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: Node Maintenance Operator 4.11.1 security update
Advisory ID: RHSA-2022:6188-01
Product: RHWA
Advisory URL: https://access.redhat.com/errata/RHSA-2022:6188
Issue date: 2022-08-25
CVE Names: CVE-2022-1292 CVE-2022-1586 CVE-2022-1705
CVE-2022-1962 CVE-2022-2068 CVE-2022-2097
CVE-2022-28131 CVE-2022-30630 CVE-2022-30631
CVE-2022-30632 CVE-2022-30633 CVE-2022-32148
=====================================================================

1. Summary:

An update for node-maintenance-must-gather-container,
node-maintenance-operator-bundle-container, and
node-maintenance-operator-container is now available for Node Maintenance
Operator 4.11 for RHEL 8. This Operator is delivered by Red Hat Workload
Availability.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

This is an updated release of the Node Maintenance Operator. The Node
Maintenance Operator cordons off nodes from the rest of the cluster and
drains all the pods from the nodes. By placing nodes under maintenance,
administrators can proactively power down nodes, move workloads to other
parts of the cluster, and ensure that workloads do not get interrupted.

Security Fix(es):

* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

* golang: net/http: improper sanitization of Transfer-Encoding header
(CVE-2022-1705)

* golang: go/parser: stack exhaustion in all Parse* functions
(CVE-2022-1962)

* golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

* golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

* golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

* golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

* golang: net/http/httputil: NewSingleHostReverseProxy - omit
X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, see the CVE page(s)
listed in the References section.

3. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, see:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
2107371 - CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
2107374 - CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
2107376 - CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
2107383 - CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
2107386 - CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
2107390 - CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
2107392 - CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal

5. References:

https://access.redhat.com/security/cve/CVE-2022-1292
https://access.redhat.com/security/cve/CVE-2022-1586
https://access.redhat.com/security/cve/CVE-2022-1705
https://access.redhat.com/security/cve/CVE-2022-1962
https://access.redhat.com/security/cve/CVE-2022-2068
https://access.redhat.com/security/cve/CVE-2022-2097
https://access.redhat.com/security/cve/CVE-2022-28131
https://access.redhat.com/security/cve/CVE-2022-30630
https://access.redhat.com/security/cve/CVE-2022-30631
https://access.redhat.com/security/cve/CVE-2022-30632
https://access.redhat.com/security/cve/CVE-2022-30633
https://access.redhat.com/security/cve/CVE-2022-32148
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYwe6gdzjgjWX9erEAQiS+g/+IhfsKqfRH2EJsNNn/WFyeLJxogITZN4l
W5egpFt9cNMXkx9RsKZR287l9vrT7BkhLsNRKkzWsYg1RMPEa36ko5Xf1sGchLHt
mMLJ26mnolPtSVseJgdeczeaMZYo6xvSzx1lmV6MKJJZBAjkhddewYlbijSz8znf
8T+yEG0kMNYzI0Mj8pLb6fldYyYVdKfLwFCXpqA9YxDAN38RtrJiF15R0MD8rhYT
FsIpnthidpK6cKpHHkeOB3R7wN7Opjz92mEzwedFpTJT/gfIiOtCbgpCEjq4Ry3u
rMn4ziM9CknQtk4KMjiJm3/Rv+8osFpWYLsitg4+t0DERCDMhTSCyhPoG6XD1EVH
2T0sY5ZhvH1C9Y0fhCKyx7aJ/0iNsGB/uYgPCo9rkuTpvtfaDdsxhPOZ5kQO6+sN
a21rS1HtWXqXSWBaEQIJRat0HGsSowVsOa9YZc5eXPvedWiCzBCag6Fuqa6ht1wI
+0EKC3O+2G7tk2wbm2mvueQmke9v93aA1ucNCWOE5V4GbbRy6yJKsQbVCErTa+YR
OH/R8n6fBZdTcgPZvKng90Mg94Tkf6fauyTiwkESMiIR3qCMf4M7rC+jQMZnss9v
+4XElYdV1K1f9S7TJ+YpueoXBJaPi+ASbLqAzPey712GAyo/LKIyzJQXkgVlMRF6
CAU70Y4WQpQ=
=+GUz
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close