RHSA-2022:1681MediumCVSS 9.8

Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes

Published
May 3, 2022
Last Modified
August 22, 2026

🔗 CVE IDs covered (14)

CVE-2022-0235 →CVE-2022-0536 →CVE-2022-0613 →CVE-2022-1365 →CVE-2022-21803 →CVE-2022-24450 →CVE-2022-24723 →CVE-2022-24771 →CVE-2022-24772 →CVE-2022-24773 →CVE-2022-24785 →CVE-2021-23555 →CVE-2021-43565 →CVE-2022-0155 →

📋 Description

CVE-2021-23555 — vm2: vulnerable to Sandbox Bypass CVE-2021-43565 — golang.org/x/crypto: empty plaintext packet causes panic CVE-2022-0155 — follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor CVE-2022-0235 — node-fetch: exposure of sensitive information to an unauthorized actor CVE-2022-0536 — follow-redirects: Exposure of Sensitive Information via Authorization Header leak CVE-2022-0613 — urijs: Authorization Bypass Through User-Controlled Key CVE-2022-1365 — cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor CVE-2022-21803 — nconf: Prototype pollution in memory store CVE-2022-24450 — nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account CVE-2022-24723 — urijs: Leading white space bypasses protocol validation CVE-2022-24771 — node-forge: Signature verification leniency in checking digestAlgorithm structure can lead to signature forgery CVE-2022-24772 — node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery CVE-2022-24773 — node-forge: Signature verification leniency in checking DigestInfo structure CVE-2022-24785 — Moment.js: Path traversal in moment.locale

🎯 Affected products200

  • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:3a5ef5f9af69a95bafce7bad92ee47a99fdd16be7a863d65effb0a5f7ae6dc97_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:4e421845874972d490c4fdd3d5006c7d6e3aa29ae7d612c4a9bb7ea82c52e271_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:e8e338e7f06746d98c9dac4d24b211dfd4384dc90e2afd8f0afb0d63eebd1acb_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:41afe7638cca4ca6de18a3687ec8a73c9ad7aff705188f24c250c0707b8148d1_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:a5e3e5be78920497906ed528efbe7d6ce8323cbd84733206e291183e1da72a5a_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:ab47f6c99d8f8bc0147bb12a19fd2ee9965d79441053d8d50dda4b4c0ab16081_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:16ae5f7d2350eee394083f03444c70f849a8936f051e0bbc3d843e6e83651a56_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:c2df73585248afc784498b8988c47b235d037b4c8400c41baf81f96dd12b6030_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:fbd0d763e550575a30883356dfa97f8cb328344997140646e25e8746eb541770_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/agent-service-rhel8@sha256:6d21e97852c3c0f144c7042df2a9e6a99567020a6d1cf1607cf977e1b0e92c0f_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/agent-service-rhel8@sha256:a3d62916822c2fbc43742c4e7bce4a9da7d87fdee0c3a9a806a8e5549ae78f4b_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/agent-service-rhel8@sha256:b6deaffb775887853123bac203ae1e0441014392f43ccb38e456389d20af34e4_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/application-ui-rhel8@sha256:6933722d448428a62c4d855eea2a5887fda2e61358d919b60807c6ed6ff35445_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/application-ui-rhel8@sha256:70fbf62bf34e0bc64535e70b3e312feccfa277f9625173de4eb7edc7b1fb15d1_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/application-ui-rhel8@sha256:a52b3ef93115568225a33cda753c861cf39ed884af7723bae3a907a193352ab0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-image-service-rhel8@sha256:53ff53bb8cc4595dd0a11edae710a234c7c88cc48f2853e4e6beb41bcc90061d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-image-service-rhel8@sha256:592134c8bf4b4936fd863433a2a9a70d593d8e2c6eb849d8e1d6d8487707b6f9_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-image-service-rhel8@sha256:bea96ea5dd45450d72b444fc66f74291f89114b1fabdf445a95fdbda33ab2b0c_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-agent-rhel8@sha256:6f3335a492fc886e204f67b9907a4e0436333091b968362353483babf9b17704_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-reporter-rhel8@sha256:543c56262fc3d8bf93b1cb7334d897ad6c1d577342ae5fea5f6947b750103c8b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-reporter-rhel8@sha256:c70db51a3588c5b09a2e7c71437851da1bd81959691c84823687ec60baf4f276_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-rhel8@sha256:0c4ee68ba9a4f3bd0afd5f30e12a3615d612852209084dd973a6191e919bf07b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-rhel8@sha256:c117fc17c2fa489b6a612875afb8dfc333979450463bd79fb7d4303ab8c4ae00_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:3d863419e5590b377bf0f02011a4a792c32b5f3fa67c6a04cf4000306b88bb5e_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:62d9d7f0b8779ffa3c3c7d6f8173765457165a0d351f5a7ec63587237a93df9d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:ac68f75d7ad886a51da3d30f1131c5f024a6a8bdfc76946ec78246e8530b408d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-backup-rhel8-operator@sha256:427c16e9dca8263af2ba3a877568265bc172b0b1e557f2049c79eb654670ac08_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-backup-rhel8-operator@sha256:7471571cad73b0d5518cd6207aafa89cd7aee1e632ec91e00ad6654b481d01ca_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-backup-rhel8-operator@sha256:80b6c39d1e96c3522fb0faedc490503cd7ec249230ace46b42fe7eae7f4c1db6_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • +170 more not shown

✅ Remediation

For Red Hat Advanced Cluster Management for Kubernetes, see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/index For details on how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html-single/install/index#installing Workaround: Sanitize the user-provided locale name before passing it to Moment.js.

🔗 References (27)