RHSA-2022:6345MediumCVSS 7.5

Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.1 security updates and bug fixes

Published
September 6, 2022
Last Modified
September 30, 2026

🔗 CVE IDs covered (11)

CVE-2022-1962 →CVE-2022-30631 →CVE-2022-30632 →CVE-2022-30633 →CVE-2022-30635 →CVE-2022-1705 →CVE-2022-28131 →CVE-2022-30629 →CVE-2022-30630 →CVE-2022-31129 →CVE-2022-32148 →

📋 Description

CVE-2022-1705 — golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1962 — golang: go/parser: stack exhaustion in all Parse* functions CVE-2022-28131 — golang: encoding/xml: stack exhaustion in Decoder.Skip CVE-2022-30629 — golang: crypto/tls: session tickets lack random ticket_age_add CVE-2022-30630 — golang: io/fs: stack exhaustion in Glob CVE-2022-30631 — golang: compress/gzip: stack exhaustion in Reader.Read CVE-2022-30632 — golang: path/filepath: stack exhaustion in Glob CVE-2022-30633 — golang: encoding/xml: stack exhaustion in Unmarshal CVE-2022-30635 — golang: encoding/gob: stack exhaustion in Decoder.Decode CVE-2022-31129 — moment: inefficient parsing algorithm resulting in DoS CVE-2022-32148 — golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working

🎯 Affected products154

  • multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:661ee3a57d860a713ffb481ea87858f20fce1e57b858821cb0c1ec4069e206a0_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:8cb5ab317ccc6b1bcd409cfba0ec983e3f5d9531227e76bb455011636ed32d21_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:e136966121b82373c9279b1b59b68864ed10bfdee424959a7ad4b190ff7a2562_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:fce50212c8bbfdc3e8f445f4b7ea35881eb29e49c443e827ad6fe2389328d57f_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:25b242af63aca69a32c457dde23b3ac52ed81f5edad3e919d5df59902adb0b60_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:5ea69e650771525faf944fbf3be82a19e54a964d38adbb88263247652476938c_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:c97ea925ea31a1ae6824ec55bbb43c3cf0d2d9b0fb6d12b6d23492e0e5a5467a_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:f71c4c301774aba9a886f2891eace9da47ba075d2a2e4acfc03849c9c0da57bc_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:1d250617cf4eb47800d30bd6bdd61872faa29eb7c6953edcb4a107360f0d0a78_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:3730a3c3cfb695b540945b5f0ae739a701a0155137b9509238860549105ab670_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:3d59cfa190838da34bac1ccf88562f996cc9e9ffdb151f47e044ba3fcc964a3d_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:92c8157e43d84584ba93d978fcc6ffba84118e4ea5ff46ad71a62ffdc7fc56e5_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:99e0accdee9b311b9abf032c712060823736f88c7bf3ba692349d7f8290a9570_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:b4722c060fb38e1609e689b605816cefb39a15a0ddc40837a90727d123b91c88_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:1d465abc36e2045dc5a291663786709fc920c42aacb0c34c4868a1a633334509_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:bdb861698be8305247b21ebab7994f27eaae818f691ffcff3d5b5eb5dc70a722_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:e4dd90d186f1fea6fcdb4e23f74e4390e00d134b2c21d8510c1cdbbcef3c4a1f_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:61ac4136dad0e02323807e6d3de8e890ec0b7e7e1f7112f9610410712af6f9b5_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:686b64358857be04087a706048a32b7356b16a0028d2b200da16ec94d931d25d_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:910dad58b72de16f92dd5b60d0420010d18229a6e0966fe2eb072517febe499f_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:31329737bd3608345f8e969e872e2e18305e2959d9d81867933c73fb26a53dcd_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:9797eef2012c827ff3250cba1cd542772e92872b4bd69a01bdbdba4fe407472c_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:ab7f1982f21ed9251501396ea150764348b5f61b6e50b9d74b5031e705e16ef3_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:cee69ba4c6fb326afd03c7f21856a028fa4758dab8c849ef6eaeaea0cd55afd2_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/backplane-rhel8-operator@sha256:0b8c36b4b1d00e47ee4faaeec9ccbdc2977a50592035f8a600491c657e439d33_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/backplane-rhel8-operator@sha256:5dbd590a4bbed44f487d1601d1825b5efb8253b9ee2be49adccec7e0ea9410ac_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/backplane-rhel8-operator@sha256:9f7854a1de26dfebdc8beafffd01304017b8fe7cd84065dd452de1276e529a06_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/backplane-rhel8-operator@sha256:e7998dc233af266ed94ba16450c2f02096abb5e045f291f8f94a83ef9da7dd51_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/cluster-api-provider-agent-rhel8@sha256:208389221423692530b334815985b0a2263febf5574138e854dbdc011f03b4a2_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • +124 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/multicluster_engine/install_upgrade/installing-while-connected-online-mce

🔗 References (21)