RHSA-2022:6429HighCVSS 9.8

Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.4 security and bug fix update

Published
September 13, 2022
Last Modified
August 24, 2026

🔗 CVE IDs covered (8)

CVE-2020-28500 →CVE-2021-23337 →CVE-2022-0512 →CVE-2022-0639 →CVE-2022-0686 →CVE-2022-0691 →CVE-2022-1650 →CVE-2022-30631 →

📋 Description

CVE-2020-28500 — nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions CVE-2021-23337 — nodejs-lodash: command injection via template CVE-2022-0512 — nodejs-url-parse: authorization bypass through user-controlled key CVE-2022-0639 — npm-url-parse: Authorization Bypass Through User-Controlled Key CVE-2022-0686 — npm-url-parse: Authorization bypass through user-controlled key CVE-2022-0691 — npm-url-parse: authorization bypass through user-controlled key CVE-2022-1650 — eventsource: Exposure of Sensitive Information CVE-2022-30631 — golang: compress/gzip: stack exhaustion in Reader.Read

🎯 Affected products18

  • 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-controller-rhel8@sha256:f7a1f30c7c41d792b0e10a08a70e838bd362db24eb80143276ae571f2476dad6_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-hook-runner-rhel8@sha256:c786337243812d9fa8ea8f24532e43b82154d6d14bcdc8b3171b1156c0e7372e_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-legacy-rhel8-operator@sha256:745e4c70067a4d9a4bdc300fa8cfe1809383a8a0f61d86c6c91f00d275c129b6_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-log-reader-rhel8@sha256:4fe298bde2e47e70c410c7256c996c69e961c80ca541b1f38f409c95050ce52e_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-must-gather-rhel8@sha256:7eb8ceb9aa809e44a7c4aca7449c06ead2550855e0d1a924228acd1498af59f7_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-openvpn-rhel8@sha256:e2fbf4416b52c5a9fb9c7a9c5f5ed4f865e50114ab2241b3352dff018710a467_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-operator-bundle@sha256:3f7f986af79180370ff64404595adcf2852afc6bdf9405aad19095d539096c36_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-registry-rhel8@sha256:0c476ff9c1bb0bb6afe5d93274d2ffa8f69eb93f1f240de2c0fe9c666f6c225f_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-rhel8-operator@sha256:0d8367d8e3d2babac920199a90aa93bc6c1de0f90ab0fbbef7c7b19df2556c18_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:cf62dcc9b9a81bc3a7b13bb302f13ae891327e78f253a3eb7ee696911ab38561_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-ui-rhel8@sha256:7a64556b6cb9e84635f06bd0ec2c6294302229c53f4fb7d34f5e941ca84712ad_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-plugin-for-aws-rhel8@sha256:640a1c9bed3a04580cd47233d643d4c394a904be900698f6fa2d2a78223504f8_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8@sha256:afe5e71a36eba86c80351bf442cb8bfa58f494eda9757e7efc1db1229db55c7a_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8@sha256:dc25cf4cbda5e0087f30be64e5530c02d235ddc80ea13a0e867fe75874080242_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-restic-restore-helper-rhel8@sha256:f9bd87d58290e5f3761d44a9cb1da6c91fcd1ad0a11a8a62b59035d9d201eaf2_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-rhel8@sha256:d9541b848e089cebc07bf69facedcedee470268ba9a7afd28644f797bfbae8a4_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-velero-plugin-rhel8@sha256:016aed43d06aff0c2beb7f47fa45982118c2f039693bcfd7fb94f4ba88eb845a_amd64 as a component of 8Base-RHMTC-1.7

✅ Remediation

For details on how to install and use MTC, refer to: https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html

🔗 References (11)