-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Secondary Scheduler Operator for Red Hat OpenShift 1.1.1 security update Advisory ID: RHSA-2023:0584-01 Product: OSSO Advisory URL: https://access.redhat.com/errata/RHSA-2023:0584 Issue date: 2023-05-18 CVE Names: CVE-2021-46848 CVE-2022-1304 CVE-2022-1586 CVE-2022-2880 CVE-2022-4304 CVE-2022-4415 CVE-2022-4450 CVE-2022-22624 CVE-2022-22628 CVE-2022-22629 CVE-2022-22662 CVE-2022-26700 CVE-2022-26709 CVE-2022-26710 CVE-2022-26716 CVE-2022-26717 CVE-2022-26719 CVE-2022-27664 CVE-2022-30293 CVE-2022-32189 CVE-2022-32190 CVE-2022-34903 CVE-2022-35737 CVE-2022-40303 CVE-2022-40304 CVE-2022-41715 CVE-2022-41717 CVE-2022-41724 CVE-2022-41725 CVE-2022-42898 CVE-2022-47629 CVE-2023-0215 CVE-2023-0286 CVE-2023-0361 CVE-2023-23916 ===================================================================== 1. Summary: Secondary Scheduler Operator for Red Hat OpenShift 1.1.1 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Secondary Scheduler Operator for Red Hat OpenShift 1.1.1 Security Fix(es): * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880) * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664) * golang: net/url: JoinPath does not strip relative path components in all circumstances (CVE-2022-32190) * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715) * golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717) * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724) * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725) * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4. Bugs fixed (https://bugzilla.redhat.com/): 2113814 - CVE-2022-32189 golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service 2124668 - CVE-2022-32190 golang: net/url: JoinPath does not strip relative path components in all circumstances 2124669 - CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY 2132868 - CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters 2132872 - CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps 2161274 - CVE-2022-41717 golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests 2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption 2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics 5. JIRA issues fixed (https://issues.jboss.org/): WRKLDS-653 - New SSO 1.1.1 release to address existing CVEs 6. References: https://access.redhat.com/security/cve/CVE-2021-46848 https://access.redhat.com/security/cve/CVE-2022-1304 https://access.redhat.com/security/cve/CVE-2022-1586 https://access.redhat.com/security/cve/CVE-2022-2880 https://access.redhat.com/security/cve/CVE-2022-4304 https://access.redhat.com/security/cve/CVE-2022-4415 https://access.redhat.com/security/cve/CVE-2022-4450 https://access.redhat.com/security/cve/CVE-2022-22624 https://access.redhat.com/security/cve/CVE-2022-22628 https://access.redhat.com/security/cve/CVE-2022-22629 https://access.redhat.com/security/cve/CVE-2022-22662 https://access.redhat.com/security/cve/CVE-2022-26700 https://access.redhat.com/security/cve/CVE-2022-26709 https://access.redhat.com/security/cve/CVE-2022-26710 https://access.redhat.com/security/cve/CVE-2022-26716 https://access.redhat.com/security/cve/CVE-2022-26717 https://access.redhat.com/security/cve/CVE-2022-26719 https://access.redhat.com/security/cve/CVE-2022-27664 https://access.redhat.com/security/cve/CVE-2022-30293 https://access.redhat.com/security/cve/CVE-2022-32189 https://access.redhat.com/security/cve/CVE-2022-32190 https://access.redhat.com/security/cve/CVE-2022-34903 https://access.redhat.com/security/cve/CVE-2022-35737 https://access.redhat.com/security/cve/CVE-2022-40303 https://access.redhat.com/security/cve/CVE-2022-40304 https://access.redhat.com/security/cve/CVE-2022-41715 https://access.redhat.com/security/cve/CVE-2022-41717 https://access.redhat.com/security/cve/CVE-2022-41724 https://access.redhat.com/security/cve/CVE-2022-41725 https://access.redhat.com/security/cve/CVE-2022-42898 https://access.redhat.com/security/cve/CVE-2022-47629 https://access.redhat.com/security/cve/CVE-2023-0215 https://access.redhat.com/security/cve/CVE-2023-0286 https://access.redhat.com/security/cve/CVE-2023-0361 https://access.redhat.com/security/cve/CVE-2023-23916 https://access.redhat.com/security/updates/classification/#moderate 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZGa599zjgjWX9erEAQhr4A/+Ki9SxUDxWnm1pb4AEOxtHInGixGrqqsu xXRmwFcqSYJfXKYmr4Cwkcf5oVlDObHfKhcLqpFm4r1jOF37vMNfI3nrGSVaQ1dc bcqExxXWUPZQHBj25a6oKZx5To87fYrV7axeaeuYh+E2ktT1yEr619zCVlqisw1T nB/RdchGNEjZk9galUH63fzdZVQ3pbvaVBkOgTez5D9CK7Dw/PADAcTgKvFMa9Qk NBqihu0JemHi0wzCfIC/ozskEqdyE15Ut8pCywlD860VGSURR2T3zTzYATSmzzBK +EeI0P6/g7qWMBO7ldXlE22JriK5t97rY2EIR8bX9uiKrIVtppkpclxx76/QceMR zFFuh89SZLNhXLBZbtukLVhSudIecKHB+ytbYsY5YWaxcOuyj4/27odSCT8ftwkY QhzERjurqMJKS6k4JqfcAvJgsmIM1+f6Ct6XCgFcl4oj6pYYGaSk7IUOYtLdmj6u kNyW0C8HCmBST4lNrSmaj61+lgt4w6vA/398iS3R2QqHRdyffsA9w/zXHN9sEXOn OrD0RAA6+9wNq818HmKeZB5GDc0d9UOPCxfMepfUXahqKeTTDlKikzpUlrQ4l5c2 MlI6MgX8rTc+DwZnNCZ3r3MWWtSutmVuZ4fFrDv60GrDpMnMqt1XUawSIAvDcYuv 5jEpoBq/I5k= =Ryg7 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce