rhsa-2023_0692
Vulnerability from csaf_redhat
Published
2023-02-09 01:07
Modified
2024-11-13 23:54
Summary
Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.0.7 security and bug fix update

Notes

Topic
OpenShift API for Data Protection (OADP) 1.0.7 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenShift API for Data Protection (OADP) enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and snapshot-based backups for persistent volumes. Security Fix(es) from Bugzilla: * golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags (CVE-2022-32149) * golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "OpenShift API for Data Protection (OADP) 1.0.7 is now available.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift API for Data Protection (OADP) enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and snapshot-based backups for persistent volumes.\n\nSecurity Fix(es) from Bugzilla:\n\n* golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags (CVE-2022-32149)\n\n* golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:0692",
        "url": "https://access.redhat.com/errata/RHSA-2023:0692"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2134010",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134010"
      },
      {
        "category": "external",
        "summary": "2161274",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161274"
      },
      {
        "category": "external",
        "summary": "MIG-1050",
        "url": "https://issues.redhat.com/browse/MIG-1050"
      },
      {
        "category": "external",
        "summary": "OADP-1180",
        "url": "https://issues.redhat.com/browse/OADP-1180"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0692.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.0.7 security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-13T23:54:23+00:00",
      "generator": {
        "date": "2024-11-13T23:54:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2023:0692",
      "initial_release_date": "2023-02-09T01:07:26+00:00",
      "revision_history": [
        {
          "date": "2023-02-09T01:07:26+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-02-09T01:07:26+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-13T23:54:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "8Base-OADP-1.0",
                "product": {
                  "name": "8Base-OADP-1.0",
                  "product_id": "8Base-OADP-1.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_api_data_protection:1.0::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenShift API for Data Protection"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:3749d7386635cf598147d5021584672ab26761b9dca52ca05b179d47557ac549_amd64",
                "product": {
                  "name": "oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:3749d7386635cf598147d5021584672ab26761b9dca52ca05b179d47557ac549_amd64",
                  "product_id": "oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:3749d7386635cf598147d5021584672ab26761b9dca52ca05b179d47557ac549_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel8@sha256:3749d7386635cf598147d5021584672ab26761b9dca52ca05b179d47557ac549?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel8\u0026tag=1.0.7-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-mustgather-rhel8@sha256:f269ee31bf0eb544ccabb2d72d807dc5d6587186d76bb020a00fac20221c7b0f_amd64",
                "product": {
                  "name": "oadp/oadp-mustgather-rhel8@sha256:f269ee31bf0eb544ccabb2d72d807dc5d6587186d76bb020a00fac20221c7b0f_amd64",
                  "product_id": "oadp/oadp-mustgather-rhel8@sha256:f269ee31bf0eb544ccabb2d72d807dc5d6587186d76bb020a00fac20221c7b0f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-mustgather-rhel8@sha256:f269ee31bf0eb544ccabb2d72d807dc5d6587186d76bb020a00fac20221c7b0f?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel8\u0026tag=1.0.7-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-operator-bundle@sha256:d0927b9f279ad60a073773ec624dc66db000b3d0b727254fbadb6af3a3c7b646_amd64",
                "product": {
                  "name": "oadp/oadp-operator-bundle@sha256:d0927b9f279ad60a073773ec624dc66db000b3d0b727254fbadb6af3a3c7b646_amd64",
                  "product_id": "oadp/oadp-operator-bundle@sha256:d0927b9f279ad60a073773ec624dc66db000b3d0b727254fbadb6af3a3c7b646_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-operator-bundle@sha256:d0927b9f279ad60a073773ec624dc66db000b3d0b727254fbadb6af3a3c7b646?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-operator-bundle\u0026tag=1.0.7-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-rhel8-operator@sha256:4d983585501df88bd5f602010cb72ea460982b25fa91c05a83f0b711a457661a_amd64",
                "product": {
                  "name": "oadp/oadp-rhel8-operator@sha256:4d983585501df88bd5f602010cb72ea460982b25fa91c05a83f0b711a457661a_amd64",
                  "product_id": "oadp/oadp-rhel8-operator@sha256:4d983585501df88bd5f602010cb72ea460982b25fa91c05a83f0b711a457661a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-rhel8-operator@sha256:4d983585501df88bd5f602010cb72ea460982b25fa91c05a83f0b711a457661a?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-rhel8-operator\u0026tag=1.0.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-registry-rhel8@sha256:ea215cbf22a37c2f2b77c9901dc5c7493f1f3a694276f42d11fcefbf045a8b38_amd64",
                "product": {
                  "name": "oadp/oadp-registry-rhel8@sha256:ea215cbf22a37c2f2b77c9901dc5c7493f1f3a694276f42d11fcefbf045a8b38_amd64",
                  "product_id": "oadp/oadp-registry-rhel8@sha256:ea215cbf22a37c2f2b77c9901dc5c7493f1f3a694276f42d11fcefbf045a8b38_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-registry-rhel8@sha256:ea215cbf22a37c2f2b77c9901dc5c7493f1f3a694276f42d11fcefbf045a8b38?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-registry-rhel8\u0026tag=1.0.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-rhel8@sha256:a5973be01956a09f75bcd65481d484c12fd7bcefad5b852fd0567f6d8b51f0be_amd64",
                "product": {
                  "name": "oadp/oadp-velero-rhel8@sha256:a5973be01956a09f75bcd65481d484c12fd7bcefad5b852fd0567f6d8b51f0be_amd64",
                  "product_id": "oadp/oadp-velero-rhel8@sha256:a5973be01956a09f75bcd65481d484c12fd7bcefad5b852fd0567f6d8b51f0be_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-rhel8@sha256:a5973be01956a09f75bcd65481d484c12fd7bcefad5b852fd0567f6d8b51f0be?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel8\u0026tag=1.0.7-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-plugin-rhel8@sha256:d9a46e3da52db4880cde8faa6f5e406039e6f38585dd14dc97db4b5846b4f7e5_amd64",
                "product": {
                  "name": "oadp/oadp-velero-plugin-rhel8@sha256:d9a46e3da52db4880cde8faa6f5e406039e6f38585dd14dc97db4b5846b4f7e5_amd64",
                  "product_id": "oadp/oadp-velero-plugin-rhel8@sha256:d9a46e3da52db4880cde8faa6f5e406039e6f38585dd14dc97db4b5846b4f7e5_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-plugin-rhel8@sha256:d9a46e3da52db4880cde8faa6f5e406039e6f38585dd14dc97db4b5846b4f7e5?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel8\u0026tag=1.0.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-plugin-for-aws-rhel8@sha256:1792552893fe7f146f04033f342e9095f0068dd60e1f3a1e2dad9c5111dd28e6_amd64",
                "product": {
                  "name": "oadp/oadp-velero-plugin-for-aws-rhel8@sha256:1792552893fe7f146f04033f342e9095f0068dd60e1f3a1e2dad9c5111dd28e6_amd64",
                  "product_id": "oadp/oadp-velero-plugin-for-aws-rhel8@sha256:1792552893fe7f146f04033f342e9095f0068dd60e1f3a1e2dad9c5111dd28e6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel8@sha256:1792552893fe7f146f04033f342e9095f0068dd60e1f3a1e2dad9c5111dd28e6?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel8\u0026tag=1.0.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-plugin-for-csi-rhel8@sha256:aed05c3b1e7eee9054ee45b499e2eb31a534979468ba22be46f83459d0dab4ae_amd64",
                "product": {
                  "name": "oadp/oadp-velero-plugin-for-csi-rhel8@sha256:aed05c3b1e7eee9054ee45b499e2eb31a534979468ba22be46f83459d0dab4ae_amd64",
                  "product_id": "oadp/oadp-velero-plugin-for-csi-rhel8@sha256:aed05c3b1e7eee9054ee45b499e2eb31a534979468ba22be46f83459d0dab4ae_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-plugin-for-csi-rhel8@sha256:aed05c3b1e7eee9054ee45b499e2eb31a534979468ba22be46f83459d0dab4ae?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel8\u0026tag=1.0.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:82ebe14f59b19d628ecbe63a212ecaf4623a98a432b8b4525b118c6b24c87d90_amd64",
                "product": {
                  "name": "oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:82ebe14f59b19d628ecbe63a212ecaf4623a98a432b8b4525b118c6b24c87d90_amd64",
                  "product_id": "oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:82ebe14f59b19d628ecbe63a212ecaf4623a98a432b8b4525b118c6b24c87d90_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel8@sha256:82ebe14f59b19d628ecbe63a212ecaf4623a98a432b8b4525b118c6b24c87d90?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel8\u0026tag=1.0.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1200ba024b3301c4ea18817c81e06133a52bcc7565302ebf9aa4677080b64e56_amd64",
                "product": {
                  "name": "oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1200ba024b3301c4ea18817c81e06133a52bcc7565302ebf9aa4677080b64e56_amd64",
                  "product_id": "oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1200ba024b3301c4ea18817c81e06133a52bcc7565302ebf9aa4677080b64e56_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1200ba024b3301c4ea18817c81e06133a52bcc7565302ebf9aa4677080b64e56?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel8\u0026tag=1.0.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-restic-restore-helper-rhel8@sha256:9fda0732f74519e71a4f10f10b32a451f01c3bf9eae37f7bd1ff90ad8baf3a9f_amd64",
                "product": {
                  "name": "oadp/oadp-velero-restic-restore-helper-rhel8@sha256:9fda0732f74519e71a4f10f10b32a451f01c3bf9eae37f7bd1ff90ad8baf3a9f_amd64",
                  "product_id": "oadp/oadp-velero-restic-restore-helper-rhel8@sha256:9fda0732f74519e71a4f10f10b32a451f01c3bf9eae37f7bd1ff90ad8baf3a9f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-restic-restore-helper-rhel8@sha256:9fda0732f74519e71a4f10f10b32a451f01c3bf9eae37f7bd1ff90ad8baf3a9f?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel8\u0026tag=1.0.7-5"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:3749d7386635cf598147d5021584672ab26761b9dca52ca05b179d47557ac549_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:3749d7386635cf598147d5021584672ab26761b9dca52ca05b179d47557ac549_amd64"
        },
        "product_reference": "oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:3749d7386635cf598147d5021584672ab26761b9dca52ca05b179d47557ac549_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-mustgather-rhel8@sha256:f269ee31bf0eb544ccabb2d72d807dc5d6587186d76bb020a00fac20221c7b0f_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:f269ee31bf0eb544ccabb2d72d807dc5d6587186d76bb020a00fac20221c7b0f_amd64"
        },
        "product_reference": "oadp/oadp-mustgather-rhel8@sha256:f269ee31bf0eb544ccabb2d72d807dc5d6587186d76bb020a00fac20221c7b0f_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-operator-bundle@sha256:d0927b9f279ad60a073773ec624dc66db000b3d0b727254fbadb6af3a3c7b646_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d0927b9f279ad60a073773ec624dc66db000b3d0b727254fbadb6af3a3c7b646_amd64"
        },
        "product_reference": "oadp/oadp-operator-bundle@sha256:d0927b9f279ad60a073773ec624dc66db000b3d0b727254fbadb6af3a3c7b646_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-registry-rhel8@sha256:ea215cbf22a37c2f2b77c9901dc5c7493f1f3a694276f42d11fcefbf045a8b38_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:ea215cbf22a37c2f2b77c9901dc5c7493f1f3a694276f42d11fcefbf045a8b38_amd64"
        },
        "product_reference": "oadp/oadp-registry-rhel8@sha256:ea215cbf22a37c2f2b77c9901dc5c7493f1f3a694276f42d11fcefbf045a8b38_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-rhel8-operator@sha256:4d983585501df88bd5f602010cb72ea460982b25fa91c05a83f0b711a457661a_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:4d983585501df88bd5f602010cb72ea460982b25fa91c05a83f0b711a457661a_amd64"
        },
        "product_reference": "oadp/oadp-rhel8-operator@sha256:4d983585501df88bd5f602010cb72ea460982b25fa91c05a83f0b711a457661a_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-plugin-for-aws-rhel8@sha256:1792552893fe7f146f04033f342e9095f0068dd60e1f3a1e2dad9c5111dd28e6_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:1792552893fe7f146f04033f342e9095f0068dd60e1f3a1e2dad9c5111dd28e6_amd64"
        },
        "product_reference": "oadp/oadp-velero-plugin-for-aws-rhel8@sha256:1792552893fe7f146f04033f342e9095f0068dd60e1f3a1e2dad9c5111dd28e6_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-plugin-for-csi-rhel8@sha256:aed05c3b1e7eee9054ee45b499e2eb31a534979468ba22be46f83459d0dab4ae_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:aed05c3b1e7eee9054ee45b499e2eb31a534979468ba22be46f83459d0dab4ae_amd64"
        },
        "product_reference": "oadp/oadp-velero-plugin-for-csi-rhel8@sha256:aed05c3b1e7eee9054ee45b499e2eb31a534979468ba22be46f83459d0dab4ae_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:82ebe14f59b19d628ecbe63a212ecaf4623a98a432b8b4525b118c6b24c87d90_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:82ebe14f59b19d628ecbe63a212ecaf4623a98a432b8b4525b118c6b24c87d90_amd64"
        },
        "product_reference": "oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:82ebe14f59b19d628ecbe63a212ecaf4623a98a432b8b4525b118c6b24c87d90_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1200ba024b3301c4ea18817c81e06133a52bcc7565302ebf9aa4677080b64e56_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1200ba024b3301c4ea18817c81e06133a52bcc7565302ebf9aa4677080b64e56_amd64"
        },
        "product_reference": "oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1200ba024b3301c4ea18817c81e06133a52bcc7565302ebf9aa4677080b64e56_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-plugin-rhel8@sha256:d9a46e3da52db4880cde8faa6f5e406039e6f38585dd14dc97db4b5846b4f7e5_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:d9a46e3da52db4880cde8faa6f5e406039e6f38585dd14dc97db4b5846b4f7e5_amd64"
        },
        "product_reference": "oadp/oadp-velero-plugin-rhel8@sha256:d9a46e3da52db4880cde8faa6f5e406039e6f38585dd14dc97db4b5846b4f7e5_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-restic-restore-helper-rhel8@sha256:9fda0732f74519e71a4f10f10b32a451f01c3bf9eae37f7bd1ff90ad8baf3a9f_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:9fda0732f74519e71a4f10f10b32a451f01c3bf9eae37f7bd1ff90ad8baf3a9f_amd64"
        },
        "product_reference": "oadp/oadp-velero-restic-restore-helper-rhel8@sha256:9fda0732f74519e71a4f10f10b32a451f01c3bf9eae37f7bd1ff90ad8baf3a9f_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-rhel8@sha256:a5973be01956a09f75bcd65481d484c12fd7bcefad5b852fd0567f6d8b51f0be_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:a5973be01956a09f75bcd65481d484c12fd7bcefad5b852fd0567f6d8b51f0be_amd64"
        },
        "product_reference": "oadp/oadp-velero-rhel8@sha256:a5973be01956a09f75bcd65481d484c12fd7bcefad5b852fd0567f6d8b51f0be_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-32149",
      "cwe": {
        "id": "CWE-407",
        "name": "Inefficient Algorithmic Complexity"
      },
      "discovery_date": "2022-10-12T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:3749d7386635cf598147d5021584672ab26761b9dca52ca05b179d47557ac549_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:f269ee31bf0eb544ccabb2d72d807dc5d6587186d76bb020a00fac20221c7b0f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d0927b9f279ad60a073773ec624dc66db000b3d0b727254fbadb6af3a3c7b646_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:ea215cbf22a37c2f2b77c9901dc5c7493f1f3a694276f42d11fcefbf045a8b38_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:4d983585501df88bd5f602010cb72ea460982b25fa91c05a83f0b711a457661a_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:1792552893fe7f146f04033f342e9095f0068dd60e1f3a1e2dad9c5111dd28e6_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:aed05c3b1e7eee9054ee45b499e2eb31a534979468ba22be46f83459d0dab4ae_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:82ebe14f59b19d628ecbe63a212ecaf4623a98a432b8b4525b118c6b24c87d90_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1200ba024b3301c4ea18817c81e06133a52bcc7565302ebf9aa4677080b64e56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:d9a46e3da52db4880cde8faa6f5e406039e6f38585dd14dc97db4b5846b4f7e5_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:9fda0732f74519e71a4f10f10b32a451f01c3bf9eae37f7bd1ff90ad8baf3a9f_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2134010"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in the golang.org/x/text/language package. An attacker can craft an Accept-Language header which ParseAcceptLanguage will take significant time to parse. This issue leads to a denial of service, and can impact availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:a5973be01956a09f75bcd65481d484c12fd7bcefad5b852fd0567f6d8b51f0be_amd64"
        ],
        "known_not_affected": [
          "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:3749d7386635cf598147d5021584672ab26761b9dca52ca05b179d47557ac549_amd64",
          "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:f269ee31bf0eb544ccabb2d72d807dc5d6587186d76bb020a00fac20221c7b0f_amd64",
          "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d0927b9f279ad60a073773ec624dc66db000b3d0b727254fbadb6af3a3c7b646_amd64",
          "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:ea215cbf22a37c2f2b77c9901dc5c7493f1f3a694276f42d11fcefbf045a8b38_amd64",
          "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:4d983585501df88bd5f602010cb72ea460982b25fa91c05a83f0b711a457661a_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:1792552893fe7f146f04033f342e9095f0068dd60e1f3a1e2dad9c5111dd28e6_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:aed05c3b1e7eee9054ee45b499e2eb31a534979468ba22be46f83459d0dab4ae_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:82ebe14f59b19d628ecbe63a212ecaf4623a98a432b8b4525b118c6b24c87d90_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1200ba024b3301c4ea18817c81e06133a52bcc7565302ebf9aa4677080b64e56_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:d9a46e3da52db4880cde8faa6f5e406039e6f38585dd14dc97db4b5846b4f7e5_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:9fda0732f74519e71a4f10f10b32a451f01c3bf9eae37f7bd1ff90ad8baf3a9f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-32149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2134010",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134010"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-32149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-32149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-32149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32149"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/56152",
          "url": "https://go.dev/issue/56152"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/qfPIly0X7aU",
          "url": "https://groups.google.com/g/golang-dev/c/qfPIly0X7aU"
        }
      ],
      "release_date": "2022-10-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-09T01:07:26+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:a5973be01956a09f75bcd65481d484c12fd7bcefad5b852fd0567f6d8b51f0be_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0692"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:a5973be01956a09f75bcd65481d484c12fd7bcefad5b852fd0567f6d8b51f0be_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags"
    },
    {
      "cve": "CVE-2022-41717",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2023-01-16T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:3749d7386635cf598147d5021584672ab26761b9dca52ca05b179d47557ac549_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:f269ee31bf0eb544ccabb2d72d807dc5d6587186d76bb020a00fac20221c7b0f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d0927b9f279ad60a073773ec624dc66db000b3d0b727254fbadb6af3a3c7b646_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:4d983585501df88bd5f602010cb72ea460982b25fa91c05a83f0b711a457661a_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:1792552893fe7f146f04033f342e9095f0068dd60e1f3a1e2dad9c5111dd28e6_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:aed05c3b1e7eee9054ee45b499e2eb31a534979468ba22be46f83459d0dab4ae_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:82ebe14f59b19d628ecbe63a212ecaf4623a98a432b8b4525b118c6b24c87d90_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1200ba024b3301c4ea18817c81e06133a52bcc7565302ebf9aa4677080b64e56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:d9a46e3da52db4880cde8faa6f5e406039e6f38585dd14dc97db4b5846b4f7e5_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:9fda0732f74519e71a4f10f10b32a451f01c3bf9eae37f7bd1ff90ad8baf3a9f_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:a5973be01956a09f75bcd65481d484c12fd7bcefad5b852fd0567f6d8b51f0be_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2161274"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Within Red Hat OpenShift Container Platform, the grafana container is listed as will not fix. Since OCP 4.10, Grafana itself is not shipped and the Grafana web server is protected behind an OAuth proxy server.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:ea215cbf22a37c2f2b77c9901dc5c7493f1f3a694276f42d11fcefbf045a8b38_amd64"
        ],
        "known_not_affected": [
          "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:3749d7386635cf598147d5021584672ab26761b9dca52ca05b179d47557ac549_amd64",
          "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:f269ee31bf0eb544ccabb2d72d807dc5d6587186d76bb020a00fac20221c7b0f_amd64",
          "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d0927b9f279ad60a073773ec624dc66db000b3d0b727254fbadb6af3a3c7b646_amd64",
          "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:4d983585501df88bd5f602010cb72ea460982b25fa91c05a83f0b711a457661a_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:1792552893fe7f146f04033f342e9095f0068dd60e1f3a1e2dad9c5111dd28e6_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:aed05c3b1e7eee9054ee45b499e2eb31a534979468ba22be46f83459d0dab4ae_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:82ebe14f59b19d628ecbe63a212ecaf4623a98a432b8b4525b118c6b24c87d90_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:1200ba024b3301c4ea18817c81e06133a52bcc7565302ebf9aa4677080b64e56_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:d9a46e3da52db4880cde8faa6f5e406039e6f38585dd14dc97db4b5846b4f7e5_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:9fda0732f74519e71a4f10f10b32a451f01c3bf9eae37f7bd1ff90ad8baf3a9f_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:a5973be01956a09f75bcd65481d484c12fd7bcefad5b852fd0567f6d8b51f0be_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-41717"
        },
        {
          "category": "external",
          "summary": "RHBZ#2161274",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161274"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41717",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-41717"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/455635",
          "url": "https://go.dev/cl/455635"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/455717",
          "url": "https://go.dev/cl/455717"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/56350",
          "url": "https://go.dev/issue/56350"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ",
          "url": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2022-1144",
          "url": "https://pkg.go.dev/vuln/GO-2022-1144"
        }
      ],
      "release_date": "2022-11-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-09T01:07:26+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:ea215cbf22a37c2f2b77c9901dc5c7493f1f3a694276f42d11fcefbf045a8b38_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0692"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:ea215cbf22a37c2f2b77c9901dc5c7493f1f3a694276f42d11fcefbf045a8b38_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.