csaf_redhat - rhba-2023

rhba-2023_3611

Vulnerability from csaf_redhat

Published

2023-06-15 00:29

Modified

2024-11-23 00:27

Summary

Red Hat Bug Fix Advisory: Release of Bug Advisories for the OpenShift Jenkins and Jenkins agent base image

Notes

Topic

Release of Bug Advisories for the OpenShift Jenkins image and Jenkins agent base image

Details

Release of Bug Advisories for the OpenShift Jenkins image and Jenkins agent base image

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Release of Bug Advisories for the OpenShift Jenkins image and Jenkins agent base image",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Release of Bug Advisories for the OpenShift Jenkins image and Jenkins agent base image",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2023:3611",
        "url": "https://access.redhat.com/errata/RHBA-2023:3611"
      },
      {
        "category": "external",
        "summary": "https://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html",
        "url": "https://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-13652",
        "url": "https://issues.redhat.com/browse/OCPBUGS-13652"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-14393",
        "url": "https://issues.redhat.com/browse/OCPBUGS-14393"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-14642",
        "url": "https://issues.redhat.com/browse/OCPBUGS-14642"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-6632",
        "url": "https://issues.redhat.com/browse/OCPBUGS-6632"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-7016",
        "url": "https://issues.redhat.com/browse/OCPBUGS-7016"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-7017",
        "url": "https://issues.redhat.com/browse/OCPBUGS-7017"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_3611.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: Release of Bug Advisories for the OpenShift Jenkins and Jenkins agent base image",
    "tracking": {
      "current_release_date": "2024-11-23T00:27:58+00:00",
      "generator": {
        "date": "2024-11-23T00:27:58+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHBA-2023:3611",
      "initial_release_date": "2023-06-15T00:29:54+00:00",
      "revision_history": [
        {
          "date": "2023-06-15T00:29:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-06-15T00:29:54+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-23T00:27:58+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift Developer Tools and Services for OCP 4.12",
                "product": {
                  "name": "OpenShift Developer Tools and Services for OCP 4.12",
                  "product_id": "8Base-OCP-Tools-4.12",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ocp_tools:4.12::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenShift Jenkins"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:d2b1d82bb799a1be9d814c756bcb62d56fcd6e508e931b74cada392a20818af6_amd64",
                "product": {
                  "name": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:d2b1d82bb799a1be9d814c756bcb62d56fcd6e508e931b74cada392a20818af6_amd64",
                  "product_id": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:d2b1d82bb799a1be9d814c756bcb62d56fcd6e508e931b74cada392a20818af6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jenkins-agent-base-rhel8@sha256:d2b1d82bb799a1be9d814c756bcb62d56fcd6e508e931b74cada392a20818af6?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=v4.12.0-1686649619"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ocp-tools-4/jenkins-rhel8@sha256:96dd08bfa56b6e09e7b65c97eda0a679670f1996c944aadfb2f3131d1e041ebc_amd64",
                "product": {
                  "name": "ocp-tools-4/jenkins-rhel8@sha256:96dd08bfa56b6e09e7b65c97eda0a679670f1996c944aadfb2f3131d1e041ebc_amd64",
                  "product_id": "ocp-tools-4/jenkins-rhel8@sha256:96dd08bfa56b6e09e7b65c97eda0a679670f1996c944aadfb2f3131d1e041ebc_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jenkins-rhel8@sha256:96dd08bfa56b6e09e7b65c97eda0a679670f1996c944aadfb2f3131d1e041ebc?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=v4.12.0-1686650770"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:85cf90bc3dd633e33cf9d26e99f92859c530d5bcfda1098b75b984a546de71d2_arm64",
                "product": {
                  "name": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:85cf90bc3dd633e33cf9d26e99f92859c530d5bcfda1098b75b984a546de71d2_arm64",
                  "product_id": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:85cf90bc3dd633e33cf9d26e99f92859c530d5bcfda1098b75b984a546de71d2_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jenkins-agent-base-rhel8@sha256:85cf90bc3dd633e33cf9d26e99f92859c530d5bcfda1098b75b984a546de71d2?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=v4.12.0-1686649619"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ocp-tools-4/jenkins-rhel8@sha256:aba721a1e9eca5a15a170325844cfaa4f4c70f11621e4c41ec5a5bfc7b46534e_arm64",
                "product": {
                  "name": "ocp-tools-4/jenkins-rhel8@sha256:aba721a1e9eca5a15a170325844cfaa4f4c70f11621e4c41ec5a5bfc7b46534e_arm64",
                  "product_id": "ocp-tools-4/jenkins-rhel8@sha256:aba721a1e9eca5a15a170325844cfaa4f4c70f11621e4c41ec5a5bfc7b46534e_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jenkins-rhel8@sha256:aba721a1e9eca5a15a170325844cfaa4f4c70f11621e4c41ec5a5bfc7b46534e?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=v4.12.0-1686650770"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:8e32ea3e4fd183303f9d39cf2547f094767ea281871779279c11621be8c2dbc8_ppc64le",
                "product": {
                  "name": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:8e32ea3e4fd183303f9d39cf2547f094767ea281871779279c11621be8c2dbc8_ppc64le",
                  "product_id": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:8e32ea3e4fd183303f9d39cf2547f094767ea281871779279c11621be8c2dbc8_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jenkins-agent-base-rhel8@sha256:8e32ea3e4fd183303f9d39cf2547f094767ea281871779279c11621be8c2dbc8?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=v4.12.0-1686649619"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ocp-tools-4/jenkins-rhel8@sha256:815b74527294e88078bed7849245cd6af2fde55eff426de76d627cd1bee320fb_ppc64le",
                "product": {
                  "name": "ocp-tools-4/jenkins-rhel8@sha256:815b74527294e88078bed7849245cd6af2fde55eff426de76d627cd1bee320fb_ppc64le",
                  "product_id": "ocp-tools-4/jenkins-rhel8@sha256:815b74527294e88078bed7849245cd6af2fde55eff426de76d627cd1bee320fb_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jenkins-rhel8@sha256:815b74527294e88078bed7849245cd6af2fde55eff426de76d627cd1bee320fb?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=v4.12.0-1686650770"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:3d008c8fe975ab44031a6a1a524b8501acbc040d283e81982f429f31b7cf46bc_s390x",
                "product": {
                  "name": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:3d008c8fe975ab44031a6a1a524b8501acbc040d283e81982f429f31b7cf46bc_s390x",
                  "product_id": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:3d008c8fe975ab44031a6a1a524b8501acbc040d283e81982f429f31b7cf46bc_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jenkins-agent-base-rhel8@sha256:3d008c8fe975ab44031a6a1a524b8501acbc040d283e81982f429f31b7cf46bc?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=v4.12.0-1686649619"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ocp-tools-4/jenkins-rhel8@sha256:816601e12a70a9ae1c39f5933c871e4520776ed159fe73c09f46b9dace3ed4a3_s390x",
                "product": {
                  "name": "ocp-tools-4/jenkins-rhel8@sha256:816601e12a70a9ae1c39f5933c871e4520776ed159fe73c09f46b9dace3ed4a3_s390x",
                  "product_id": "ocp-tools-4/jenkins-rhel8@sha256:816601e12a70a9ae1c39f5933c871e4520776ed159fe73c09f46b9dace3ed4a3_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jenkins-rhel8@sha256:816601e12a70a9ae1c39f5933c871e4520776ed159fe73c09f46b9dace3ed4a3?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=v4.12.0-1686650770"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:3d008c8fe975ab44031a6a1a524b8501acbc040d283e81982f429f31b7cf46bc_s390x as a component of OpenShift Developer Tools and Services for OCP 4.12",
          "product_id": "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-agent-base-rhel8@sha256:3d008c8fe975ab44031a6a1a524b8501acbc040d283e81982f429f31b7cf46bc_s390x"
        },
        "product_reference": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:3d008c8fe975ab44031a6a1a524b8501acbc040d283e81982f429f31b7cf46bc_s390x",
        "relates_to_product_reference": "8Base-OCP-Tools-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:85cf90bc3dd633e33cf9d26e99f92859c530d5bcfda1098b75b984a546de71d2_arm64 as a component of OpenShift Developer Tools and Services for OCP 4.12",
          "product_id": "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-agent-base-rhel8@sha256:85cf90bc3dd633e33cf9d26e99f92859c530d5bcfda1098b75b984a546de71d2_arm64"
        },
        "product_reference": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:85cf90bc3dd633e33cf9d26e99f92859c530d5bcfda1098b75b984a546de71d2_arm64",
        "relates_to_product_reference": "8Base-OCP-Tools-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:8e32ea3e4fd183303f9d39cf2547f094767ea281871779279c11621be8c2dbc8_ppc64le as a component of OpenShift Developer Tools and Services for OCP 4.12",
          "product_id": "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-agent-base-rhel8@sha256:8e32ea3e4fd183303f9d39cf2547f094767ea281871779279c11621be8c2dbc8_ppc64le"
        },
        "product_reference": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:8e32ea3e4fd183303f9d39cf2547f094767ea281871779279c11621be8c2dbc8_ppc64le",
        "relates_to_product_reference": "8Base-OCP-Tools-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:d2b1d82bb799a1be9d814c756bcb62d56fcd6e508e931b74cada392a20818af6_amd64 as a component of OpenShift Developer Tools and Services for OCP 4.12",
          "product_id": "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-agent-base-rhel8@sha256:d2b1d82bb799a1be9d814c756bcb62d56fcd6e508e931b74cada392a20818af6_amd64"
        },
        "product_reference": "ocp-tools-4/jenkins-agent-base-rhel8@sha256:d2b1d82bb799a1be9d814c756bcb62d56fcd6e508e931b74cada392a20818af6_amd64",
        "relates_to_product_reference": "8Base-OCP-Tools-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ocp-tools-4/jenkins-rhel8@sha256:815b74527294e88078bed7849245cd6af2fde55eff426de76d627cd1bee320fb_ppc64le as a component of OpenShift Developer Tools and Services for OCP 4.12",
          "product_id": "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:815b74527294e88078bed7849245cd6af2fde55eff426de76d627cd1bee320fb_ppc64le"
        },
        "product_reference": "ocp-tools-4/jenkins-rhel8@sha256:815b74527294e88078bed7849245cd6af2fde55eff426de76d627cd1bee320fb_ppc64le",
        "relates_to_product_reference": "8Base-OCP-Tools-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ocp-tools-4/jenkins-rhel8@sha256:816601e12a70a9ae1c39f5933c871e4520776ed159fe73c09f46b9dace3ed4a3_s390x as a component of OpenShift Developer Tools and Services for OCP 4.12",
          "product_id": "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:816601e12a70a9ae1c39f5933c871e4520776ed159fe73c09f46b9dace3ed4a3_s390x"
        },
        "product_reference": "ocp-tools-4/jenkins-rhel8@sha256:816601e12a70a9ae1c39f5933c871e4520776ed159fe73c09f46b9dace3ed4a3_s390x",
        "relates_to_product_reference": "8Base-OCP-Tools-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ocp-tools-4/jenkins-rhel8@sha256:96dd08bfa56b6e09e7b65c97eda0a679670f1996c944aadfb2f3131d1e041ebc_amd64 as a component of OpenShift Developer Tools and Services for OCP 4.12",
          "product_id": "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:96dd08bfa56b6e09e7b65c97eda0a679670f1996c944aadfb2f3131d1e041ebc_amd64"
        },
        "product_reference": "ocp-tools-4/jenkins-rhel8@sha256:96dd08bfa56b6e09e7b65c97eda0a679670f1996c944aadfb2f3131d1e041ebc_amd64",
        "relates_to_product_reference": "8Base-OCP-Tools-4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ocp-tools-4/jenkins-rhel8@sha256:aba721a1e9eca5a15a170325844cfaa4f4c70f11621e4c41ec5a5bfc7b46534e_arm64 as a component of OpenShift Developer Tools and Services for OCP 4.12",
          "product_id": "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:aba721a1e9eca5a15a170325844cfaa4f4c70f11621e4c41ec5a5bfc7b46534e_arm64"
        },
        "product_reference": "ocp-tools-4/jenkins-rhel8@sha256:aba721a1e9eca5a15a170325844cfaa4f4c70f11621e4c41ec5a5bfc7b46534e_arm64",
        "relates_to_product_reference": "8Base-OCP-Tools-4.12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Philippe Antoine"
          ],
          "organization": "Catena Cyber"
        }
      ],
      "cve": "CVE-2022-41723",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-03-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-agent-base-rhel8@sha256:3d008c8fe975ab44031a6a1a524b8501acbc040d283e81982f429f31b7cf46bc_s390x",
            "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-agent-base-rhel8@sha256:85cf90bc3dd633e33cf9d26e99f92859c530d5bcfda1098b75b984a546de71d2_arm64",
            "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-agent-base-rhel8@sha256:8e32ea3e4fd183303f9d39cf2547f094767ea281871779279c11621be8c2dbc8_ppc64le",
            "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-agent-base-rhel8@sha256:d2b1d82bb799a1be9d814c756bcb62d56fcd6e508e931b74cada392a20818af6_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2178358"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Within OpenShift Container Platform, the maximum impact of this vulnerability is a denial of service against an individual container so the impact could not cascade across the entire infrastructure, this vulnerability is rated Moderate impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:815b74527294e88078bed7849245cd6af2fde55eff426de76d627cd1bee320fb_ppc64le",
          "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:816601e12a70a9ae1c39f5933c871e4520776ed159fe73c09f46b9dace3ed4a3_s390x",
          "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:96dd08bfa56b6e09e7b65c97eda0a679670f1996c944aadfb2f3131d1e041ebc_amd64",
          "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:aba721a1e9eca5a15a170325844cfaa4f4c70f11621e4c41ec5a5bfc7b46534e_arm64"
        ],
        "known_not_affected": [
          "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-agent-base-rhel8@sha256:3d008c8fe975ab44031a6a1a524b8501acbc040d283e81982f429f31b7cf46bc_s390x",
          "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-agent-base-rhel8@sha256:85cf90bc3dd633e33cf9d26e99f92859c530d5bcfda1098b75b984a546de71d2_arm64",
          "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-agent-base-rhel8@sha256:8e32ea3e4fd183303f9d39cf2547f094767ea281871779279c11621be8c2dbc8_ppc64le",
          "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-agent-base-rhel8@sha256:d2b1d82bb799a1be9d814c756bcb62d56fcd6e508e931b74cada392a20818af6_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-41723"
        },
        {
          "category": "external",
          "summary": "RHBZ#2178358",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178358"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41723",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-41723"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41723",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41723"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-vvpx-j8f3-3w6h",
          "url": "https://github.com/advisories/GHSA-vvpx-j8f3-3w6h"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/468135",
          "url": "https://go.dev/cl/468135"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/468295",
          "url": "https://go.dev/cl/468295"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/57855",
          "url": "https://go.dev/issue/57855"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E",
          "url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2023-1571",
          "url": "https://pkg.go.dev/vuln/GO-2023-1571"
        },
        {
          "category": "external",
          "summary": "https://vuln.go.dev/ID/GO-2023-1571.json",
          "url": "https://vuln.go.dev/ID/GO-2023-1571.json"
        }
      ],
      "release_date": "2023-02-17T14:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-06-15T00:29:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:815b74527294e88078bed7849245cd6af2fde55eff426de76d627cd1bee320fb_ppc64le",
            "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:816601e12a70a9ae1c39f5933c871e4520776ed159fe73c09f46b9dace3ed4a3_s390x",
            "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:96dd08bfa56b6e09e7b65c97eda0a679670f1996c944aadfb2f3131d1e041ebc_amd64",
            "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:aba721a1e9eca5a15a170325844cfaa4f4c70f11621e4c41ec5a5bfc7b46534e_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2023:3611"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:815b74527294e88078bed7849245cd6af2fde55eff426de76d627cd1bee320fb_ppc64le",
            "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:816601e12a70a9ae1c39f5933c871e4520776ed159fe73c09f46b9dace3ed4a3_s390x",
            "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:96dd08bfa56b6e09e7b65c97eda0a679670f1996c944aadfb2f3131d1e041ebc_amd64",
            "8Base-OCP-Tools-4.12:ocp-tools-4/jenkins-rhel8@sha256:aba721a1e9eca5a15a170325844cfaa4f4c70f11621e4c41ec5a5bfc7b46534e_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding"
    }
  ]
}

cve-2022-41723

Vulnerability from cvelistv5

Published

2023-02-28 17:19

Modified

2024-08-03 12:49

Severity ?

Summary

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

References

▼	URL	Tags
	https://go.dev/issue/57855
	https://go.dev/cl/468135
	https://go.dev/cl/468295
	https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
	https://pkg.go.dev/vuln/GO-2023-1571
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/
	https://www.couchbase.com/alerts/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/
	https://security.gentoo.org/glsa/202311-09

Impacted products

▼	Vendor	Product
	Go standard library	net/http
	golang.org/x/net	golang.org/x/net/http2
	golang.org/x/net	golang.org/x/net/http2/hpack

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:49:43.617Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20230331-0010/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/57855"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/468135"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/468295"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2023-1571"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.couchbase.com/alerts/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-09"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "Transport.RoundTrip"
            },
            {
              "name": "Server.Serve"
            },
            {
              "name": "Client.Do"
            },
            {
              "name": "Client.Get"
            },
            {
              "name": "Client.Head"
            },
            {
              "name": "Client.Post"
            },
            {
              "name": "Client.PostForm"
            },
            {
              "name": "Get"
            },
            {
              "name": "Head"
            },
            {
              "name": "ListenAndServe"
            },
            {
              "name": "ListenAndServeTLS"
            },
            {
              "name": "Post"
            },
            {
              "name": "PostForm"
            },
            {
              "name": "Serve"
            },
            {
              "name": "ServeTLS"
            },
            {
              "name": "Server.ListenAndServe"
            },
            {
              "name": "Server.ListenAndServeTLS"
            },
            {
              "name": "Server.ServeTLS"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.19.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.20.1",
              "status": "affected",
              "version": "1.20.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/http2",
          "product": "golang.org/x/net/http2",
          "programRoutines": [
            {
              "name": "Transport.RoundTrip"
            },
            {
              "name": "Server.ServeConn"
            },
            {
              "name": "ClientConn.Close"
            },
            {
              "name": "ClientConn.Ping"
            },
            {
              "name": "ClientConn.RoundTrip"
            },
            {
              "name": "ClientConn.Shutdown"
            },
            {
              "name": "ConfigureServer"
            },
            {
              "name": "ConfigureTransport"
            },
            {
              "name": "ConfigureTransports"
            },
            {
              "name": "ConnectionError.Error"
            },
            {
              "name": "ErrCode.String"
            },
            {
              "name": "FrameHeader.String"
            },
            {
              "name": "FrameType.String"
            },
            {
              "name": "FrameWriteRequest.String"
            },
            {
              "name": "Framer.ReadFrame"
            },
            {
              "name": "Framer.WriteContinuation"
            },
            {
              "name": "Framer.WriteData"
            },
            {
              "name": "Framer.WriteDataPadded"
            },
            {
              "name": "Framer.WriteGoAway"
            },
            {
              "name": "Framer.WriteHeaders"
            },
            {
              "name": "Framer.WritePing"
            },
            {
              "name": "Framer.WritePriority"
            },
            {
              "name": "Framer.WritePushPromise"
            },
            {
              "name": "Framer.WriteRSTStream"
            },
            {
              "name": "Framer.WriteRawFrame"
            },
            {
              "name": "Framer.WriteSettings"
            },
            {
              "name": "Framer.WriteSettingsAck"
            },
            {
              "name": "Framer.WriteWindowUpdate"
            },
            {
              "name": "GoAwayError.Error"
            },
            {
              "name": "ReadFrameHeader"
            },
            {
              "name": "Setting.String"
            },
            {
              "name": "SettingID.String"
            },
            {
              "name": "SettingsFrame.ForeachSetting"
            },
            {
              "name": "StreamError.Error"
            },
            {
              "name": "Transport.CloseIdleConnections"
            },
            {
              "name": "Transport.NewClientConn"
            },
            {
              "name": "Transport.RoundTripOpt"
            },
            {
              "name": "bufferedWriter.Flush"
            },
            {
              "name": "bufferedWriter.Write"
            },
            {
              "name": "chunkWriter.Write"
            },
            {
              "name": "clientConnPool.GetClientConn"
            },
            {
              "name": "connError.Error"
            },
            {
              "name": "dataBuffer.Read"
            },
            {
              "name": "duplicatePseudoHeaderError.Error"
            },
            {
              "name": "gzipReader.Close"
            },
            {
              "name": "gzipReader.Read"
            },
            {
              "name": "headerFieldNameError.Error"
            },
            {
              "name": "headerFieldValueError.Error"
            },
            {
              "name": "noDialClientConnPool.GetClientConn"
            },
            {
              "name": "noDialH2RoundTripper.RoundTrip"
            },
            {
              "name": "pipe.Read"
            },
            {
              "name": "priorityWriteScheduler.CloseStream"
            },
            {
              "name": "priorityWriteScheduler.OpenStream"
            },
            {
              "name": "pseudoHeaderError.Error"
            },
            {
              "name": "requestBody.Close"
            },
            {
              "name": "requestBody.Read"
            },
            {
              "name": "responseWriter.Flush"
            },
            {
              "name": "responseWriter.FlushError"
            },
            {
              "name": "responseWriter.Push"
            },
            {
              "name": "responseWriter.SetReadDeadline"
            },
            {
              "name": "responseWriter.SetWriteDeadline"
            },
            {
              "name": "responseWriter.Write"
            },
            {
              "name": "responseWriter.WriteHeader"
            },
            {
              "name": "responseWriter.WriteString"
            },
            {
              "name": "serverConn.CloseConn"
            },
            {
              "name": "serverConn.Flush"
            },
            {
              "name": "stickyErrWriter.Write"
            },
            {
              "name": "transportResponseBody.Close"
            },
            {
              "name": "transportResponseBody.Read"
            },
            {
              "name": "writeData.String"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/http2/hpack",
          "product": "golang.org/x/net/http2/hpack",
          "programRoutines": [
            {
              "name": "Decoder.parseFieldLiteral"
            },
            {
              "name": "Decoder.readString"
            },
            {
              "name": "Decoder.DecodeFull"
            },
            {
              "name": "Decoder.Write"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Philippe Antoine (Catena cyber)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE 400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-11T19:21:27.617Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/57855"
        },
        {
          "url": "https://go.dev/cl/468135"
        },
        {
          "url": "https://go.dev/cl/468295"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2023-1571"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/"
        },
        {
          "url": "https://www.couchbase.com/alerts/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-09"
        }
      ],
      "title": "Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-41723",
    "datePublished": "2023-02-28T17:19:45.801Z",
    "dateReserved": "2022-09-28T17:00:06.610Z",
    "dateUpdated": "2024-08-03T12:49:43.617Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted