Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.2 security and bug fix update

Important

A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific characters or strings to the vulnerable application, there is the potential to cause an infinite loop to occur using more memory, resulting in a denial of service.

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

A flaw was found in nodejs-lodash. A Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions is possible.

CWE-400 - Uncontrolled Resource Consumption

A flaw was found in golang.org. In x/text, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension.

CWE-129 - Improper Validation of Array Index

A flaw was found in golang.org. In x/text, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag.

CWE-129 - Improper Validation of Array Index

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

A flaw was found in fastify-reply-from. Escaping of the prefix of the proxied backend service is possible allowing an attacker, using a specially crafted URL, to gain access to directories that would otherwise be out of bounds. The highest threat from this vulnerability is to data confidentiality and integrity.

CWE-20 - Improper Input Validation

A flaw was found in fastify-http-proxy. Escaping the prefix of the proxied backend service is possible by an attacker using a specially crafted URL. The highest threat from this vulnerability is to data confidentiality and integrity.

CWE-20 - Improper Input Validation

A flaw was found in nodejs-lodash. A command injection flaw is possible through template variables.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissible length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash.

CWE-190 - Integer Overflow or Wraparound

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack.

CWE-476 - NULL Pointer Dereference