RHSA-2022:5006HighCVSS 9.3

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.3 Containers security update

Published
June 13, 2022
Last Modified
September 24, 2026

🔗 CVE IDs covered (5)

CVE-2022-23806 →CVE-2022-24675 →CVE-2022-24785 →CVE-2022-28327 →CVE-2022-1650 →

📋 Description

CVE-2022-1650 — eventsource: Exposure of Sensitive Information CVE-2022-23806 — golang: crypto/elliptic: IsOnCurve returns true for invalid field elements CVE-2022-24675 — golang: encoding/pem: fix stack overflow in Decode CVE-2022-24785 — Moment.js: Path traversal in moment.locale CVE-2022-28327 — golang: crypto/elliptic: panic caused by oversized scalar

🎯 Affected products31

  • OpenShift Service Mesh 2.1
  • openshift-service-mesh/grafana-rhel8@sha256:421fd50a8b2ee0e7765fc624827009c183925f0c3e8e05a0b764ad50cfd277cc_s390x as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/grafana-rhel8@sha256:80f846861ea0da09cfdceaf88febad3fcc81a3fbcaf152c864c0178b46da99af_amd64 as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/grafana-rhel8@sha256:fa1bea01162ee5384ff97d6fed0f17b25261c5413c40365ccf1dedd990079ddb_ppc64le as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/istio-cni-rhel8@sha256:1766bc2099296825dac5e2ac6950973f530068aee712c63e48eb0ea62c6822f8_amd64 as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/istio-cni-rhel8@sha256:461939e81840a7c1bc9c894b5cd907c781fab5a109e053619e53c333311299c3_s390x as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/istio-cni-rhel8@sha256:d35bf874ea380d8bb261dcd44acc097cfbe30a5116b1b5270345f823b08f5c6a_ppc64le as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:2a82697fb50eaea57e19a3306bdeeb500194ad2209307818e4a30e3e104efb53_amd64 as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:59318d17b29c8b1e6b2edb177a116b41ccebd935c6a4a0a64e2683080ee06151_s390x as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:82488010b224ad5ec34d428ed6e17ba973a628a871e5d11208b98f30f9e2e579_ppc64le as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/istio-rhel8-operator@sha256:190c9fbfadb21dcfb86e911beae6b0871cc8bef3d0d94f7001e9a805d61e3677_ppc64le as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/istio-rhel8-operator@sha256:2bd7402728aed0af2359038c4ec30dd82f74024a34fabc07ec92f91ec38bbb58_s390x as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/istio-rhel8-operator@sha256:bf7e1d66d324023365b266046e95e2486726728779cba6822ed66842ea72706f_amd64 as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/kiali-rhel8-operator@sha256:3a603914d980b7f50e587ae778ca80ef3ecd8c802dc94ee4045c3b79c8f3fccb_ppc64le as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/kiali-rhel8-operator@sha256:6d6a35aa10dc35bafc4dc1ba84f7490e2c81515af7d55e394c50061adbab73f8_s390x as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/kiali-rhel8-operator@sha256:81953c48689b1504a3b7493736bf95ae034f23b57904f36e63cb1ef738433f6a_amd64 as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/kiali-rhel8@sha256:180a8353d6c49ae0683c9503bca87fa63bb770f7f21eb4b7132221635a54e76a_amd64 as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/kiali-rhel8@sha256:24bf5471e8b80ecc7e7bf78697ffdeb11f9aef24dfcc1e9a70002d8595058c53_s390x as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/kiali-rhel8@sha256:b8dcb96c7f8fb1668b5ddcc8fd96e5f252ca351b128160362f188d77df24a3c9_ppc64le as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/pilot-rhel8@sha256:2cbb992dd88ec3e121c794ecb6d54ee4c2a15058d51e0302605d0be8304688f8_ppc64le as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/pilot-rhel8@sha256:6c4a161a5fc080a1ed60bce59a8e6e547d67d5f106be4c0ce6e1482462426d63_s390x as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/pilot-rhel8@sha256:7c5f3f4854e768285d2a47647a585b7bf93ee0ee0e01a0cb938c72c7f54af192_amd64 as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/prometheus-rhel8@sha256:a0faa36376620395fda20353f55dc99fe818883b6d90dba7160288498efa26aa_s390x as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/prometheus-rhel8@sha256:bf1b96c1d5debd1553a8dbac1a958c1f705f481d91ee376e339a494869b3fe3f_amd64 as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/prometheus-rhel8@sha256:dd85b4878cae2830db264bb7c01230fde316a0de8e5385ca9ea5a454156a4093_ppc64le as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/proxyv2-rhel8@sha256:215c0e0122b2d8e01721350a023741b24623884385da9cf57f32cd9bd4adb6aa_amd64 as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/proxyv2-rhel8@sha256:2fce4ae6966d9739322f7a073c137136593508b29d058bb3556aba021af25409_s390x as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/proxyv2-rhel8@sha256:915caeda1e92378cf59087213301ca07234570ae04561b9de19196bbf29475e4_ppc64le as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/ratelimit-rhel8@sha256:400e8ea6ad46cae63b321bad3e8ca30189c9d5b0713e2c0c2cf1ca811f959ad1_s390x as a component of OpenShift Service Mesh 2.1
  • openshift-service-mesh/ratelimit-rhel8@sha256:811afd6e88b72f09a091ba5304891c88afd968ddbe634622257c752374747c85_ppc64le as a component of OpenShift Service Mesh 2.1
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Sanitize the user-provided locale name before passing it to Moment.js.

🔗 References (10)