RHSA-2022:4956HighCVSS 9.8

Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes

Published
June 9, 2022
Last Modified
August 7, 2026

🔗 CVE IDs covered (14)

CVE-2022-23806 →CVE-2022-24778 →CVE-2021-3918 →CVE-2021-43565 →CVE-2022-0778 →CVE-2022-21803 →CVE-2022-24450 →CVE-2022-24785 →CVE-2022-27191 →CVE-2022-29810 →CVE-2021-41190 →CVE-2021-43816 →CVE-2021-43858 →CVE-2022-0235 →

📋 Description

CVE-2021-3918 — nodejs-json-schema: Prototype pollution vulnerability CVE-2021-41190 — opencontainers: OCI manifest and index parsing confusion CVE-2021-43565 — golang.org/x/crypto: empty plaintext packet causes panic CVE-2021-43816 — containerd: Unprivileged pod may bind mount any privileged regular file on disk CVE-2021-43858 — minio: user privilege escalation in AddUser() admin API CVE-2022-0235 — node-fetch: exposure of sensitive information to an unauthorized actor CVE-2022-0778 — openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVE-2022-21803 — nconf: Prototype pollution in memory store CVE-2022-23806 — golang: crypto/elliptic: IsOnCurve returns true for invalid field elements CVE-2022-24450 — nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account CVE-2022-24778 — imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path CVE-2022-24785 — Moment.js: Path traversal in moment.locale CVE-2022-27191 — golang: crash in a golang.org/x/crypto/ssh server CVE-2022-29810 — go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses

🎯 Affected products200

  • Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-cluster-proxy-rhel8@sha256:3f23180da46351216ee33a4bfc67f0b8aa0dd64208da7dac7f81daaec5009a11_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-cluster-proxy-rhel8@sha256:643a49afe7b5682c0f5e56941ae601aa8f5031c9c63a0bb781a422be954b0879_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-cluster-proxy-rhel8@sha256:82557f8506bcaf48e701d815ad0bedd636d99ab649d00fcb1d3b982a85a6f13b_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-cluster-proxy-rhel8@sha256:a1c196b747624e5854f93f2575b4e909420277604196d1dfc832321b2a9fccc6_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:4888007361f4b04fea8df5f2acd610d15b7aad19822f9193cadcc36fea3271c9_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:a051fefa70c33ce608f540aa08296f013edcd1391d1334abed4d48a29dbf10e9_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:cc7bbdc191ae6f6edffac7acbccfe5a998f583031564e544034253b74f5255f8_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:e5e429df456a4f67442852b2ec2535d12bf01008015f78729b64478b73a73a8c_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:48fe3ceb6445433c5b2e2e6c450c40cb1625a28a73385a799cfad235a0fe8a5b_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:90427b8c3d65c9e86f9d028f82465ab6545d0ce5504f7ea732d0df99a552983e_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:ba90df1dd10c9db92145111703096765cf94d2bcada5911cebb8b15fe5d72bf1_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:d2b420ce95e9b379ed5e02d966dbbba8bf8c551086f7cce1dbc51bb4364b4864_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:75a4563d8291173d10a675b4d23df4d3596be07e792c94249c1e769fd8c4a916_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:b7b070d75e91fb3f42d5cea0b7c65c23bcba4c039b16b56e8e8c5d093df96124_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:c3676838f9b7fa509a3fd93c27ca1cf2235499cfe8b2432277b35825df1feb03_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:d9566f7dc9a3afda4e048a518c1e8ffc3a1509a36348a16cfc9e16a81038124a_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:972a814a9c3277318bcc0280a17dd4c46db3a0df174484fed96e5fae9b4e3486_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:9cc57201629e9454f0068a5e52de12e5174b7039d0af77010466d0a15e772dc1_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:b184a3b5f22d6201a20ef664334e01b24c7d9d444c594f4058746614bc7f8269_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:c7bc5c548af389294dc2f9e5fc0f1c5735879da083119c4ca048ad01d6fd0702_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:0e33fb6df280efda4a4128bda577d3d0d2011238c4f2ef44b3d11ec5d8aa4a4f_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:1b62a3b52e0dab6fad8ee6e64fcd2d95da07f5c25f7683beb52a0e67b5e6d8c2_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:927f49fef14be90de2407952f3b98cb343eb7c6bf95139dbd5b3aff114eb4f48_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:dd76922aa861ca201422d0df111c7d2e5514d15cce3740a74c0894cf40f0d955_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-prometheus-rhel8@sha256:7c254aa1eae3534daad1fc7067be0648f38d0a86c2046f574eed202817912a82_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-prometheus-rhel8@sha256:9072ebc6cb499cc337b33525804b8fedd1967f96ac005f9fbeddfabfd67ce25b_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-prometheus-rhel8@sha256:c7fbdf9153e9b70954c349ce73ae53b7accef5fbd3cc448fb59c2bdfbc07d156_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-prometheus-rhel8@sha256:fa6f648a76c68826b76d7e7843c6911b59655cacc35495e3911929fcda458aab_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • rhacm2/acm-volsync-addon-controller-rhel8@sha256:160a12fe6a27a34778fd2d75f096d0e13ba518ac459a8337bb87eef083759084_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8
  • +170 more not shown

✅ Remediation

For Red Hat Advanced Cluster Management for Kubernetes, see the following documentation, which will be updated shortly for this release, for important instructions on installing this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.5/html-single/install/index#installing Workaround: There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Sanitize the user-provided locale name before passing it to Moment.js.

🔗 References (218)