RHSA-2022:6272MediumCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.11 security update

Published
August 31, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2022-24785 →CVE-2022-31129 →

📋 Description

CVE-2022-24785 — Moment.js: Path traversal in moment.locale CVE-2022-31129 — moment: inefficient parsing algorithm resulting in DoS

🎯 Affected products36

  • OpenShift Service Mesh 2.0
  • servicemesh-0:2.0.11-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-0:2.0.11-1.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-0:2.0.11-1.el8.src as a component of OpenShift Service Mesh 2.0
  • servicemesh-0:2.0.11-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-cni-0:2.0.11-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-cni-0:2.0.11-1.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-cni-0:2.0.11-1.el8.src as a component of OpenShift Service Mesh 2.0
  • servicemesh-cni-0:2.0.11-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-istioctl-0:2.0.11-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-istioctl-0:2.0.11-1.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-istioctl-0:2.0.11-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-mixc-0:2.0.11-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-mixc-0:2.0.11-1.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-mixc-0:2.0.11-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-mixs-0:2.0.11-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-mixs-0:2.0.11-1.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-mixs-0:2.0.11-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-operator-0:2.0.11-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-operator-0:2.0.11-1.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-operator-0:2.0.11-1.el8.src as a component of OpenShift Service Mesh 2.0
  • servicemesh-operator-0:2.0.11-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-pilot-agent-0:2.0.11-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-pilot-agent-0:2.0.11-1.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-pilot-agent-0:2.0.11-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-pilot-discovery-0:2.0.11-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-pilot-discovery-0:2.0.11-1.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-pilot-discovery-0:2.0.11-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-prometheus-0:2.14.0-18.el8.1.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-prometheus-0:2.14.0-18.el8.1.s390x as a component of OpenShift Service Mesh 2.0
  • +6 more not shown

✅ Remediation

The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html Workaround: Sanitize the user-provided locale name before passing it to Moment.js.

🔗 References (6)