RHSA-2022:6696CriticalCVSS 10.0

Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.6 security update and bug fixes

Published
September 26, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (5)

CVE-2022-36067 →CVE-2022-30629 →CVE-2022-31129 →CVE-2022-31150 →CVE-2022-31151 →

📋 Description

CVE-2022-30629 — golang: crypto/tls: session tickets lack random ticket_age_add CVE-2022-31129 — moment: inefficient parsing algorithm resulting in DoS CVE-2022-31150 — nodejs16: CRLF injection in node-undici CVE-2022-31151 — nodejs/undici: Cookie headers uncleared on cross-origin redirect CVE-2022-36067 — vm2: Sandbox Escape in vm2

🎯 Affected products200

  • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:17c53124f6c09cc839f533aee0c870078f547fef29a19803814f5c5fbc5e7939_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:644a295644e91a8976d4df02e5ccdd711d8d3c8fa409cae698671b49b96ec00a_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:9c9b992bf748282d7cdc941b7907bbcbabe69a8b287bc4195a6bc8b9d9b6cbd0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:0cca0dbb0b7adff8eaea1315b422edb6ea1778befa4772f3e6f5755fb5519196_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:63b5758cfcffe96326b090ae51d38c00ca13b35e9fe5e4354cd33e67d042c41b_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:cfc97f6c9495bac2635e016dd47049683f8ed78c932ef2c70cec2ec7be323fea_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:346215260baa3371853d15ccc451c3ac418813c5cd9b422b0ad9f2dd6ae8a511_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:cb4fca4155dc3e274712c0c7609eb6111a6e03207ddaa0d5c3c8752badc15b2c_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:cceb82a8492d7e971e515f1a0a5391a1051e4f130f7a14e412def20616e05d40_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/agent-service-rhel8@sha256:5b5046b04aa10807a6676916cf4744f0cd36c056dd3fd626304814af2d665cf9_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/agent-service-rhel8@sha256:5c89bb44eda9a0754ea1d1ca69ea260f02f060c517194251519439e4b943e46a_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/agent-service-rhel8@sha256:cfe9dfc60224b6206d6fbbc4c4ee95e378ce2da8b79c176e5e7bfdd8b0375f88_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/application-ui-rhel8@sha256:6acf7df47405a4ccb3ede12db6574a0829d28f94ea5d20d6041db1bd045a90c6_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/application-ui-rhel8@sha256:96c10e483a1c99f0ac91fb84df87ebe927e82ca35ef7e36e0f583121dcdd8b15_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/application-ui-rhel8@sha256:ffb0b475eccc16a227f13a3d0d332f9cd9b96eade52646352a7497f903edf1a2_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-image-service-rhel8@sha256:2c2f96ebf908cf415613aec65a414884ec35784e4bdcd4c4b4978aa98149af4d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-image-service-rhel8@sha256:c89023b0b424e2b8800399fc4b6cfa9336248f3222097c094d33fd2b872398aa_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-image-service-rhel8@sha256:e49c328eb815293dd606199a0b8a2bd0db6bbf5d87eeaa7902d6d4df1bb41d35_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-agent-rhel8@sha256:86fd675a09451d3ee552452999cd2c82410174f5e55dcfd4f21286559363217e_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-reporter-rhel8@sha256:dcc214165e5c895925f52673577fa73274b017e3e9017818bf5c0327b3600ffb_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-reporter-rhel8@sha256:f7004db056478b4c1b101ab0ceac24f78dbefc018a1e76e12e8a4f69fd171175_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-rhel8@sha256:6e002bec6af8e7d7b0c89bc25f4a9e3224e47f5638be7cc2a9c68a5e92447254_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-rhel8@sha256:815976efa30282899af7de91b5df1fdeca10c709d0fc60d09d8f3abb1c2acdc3_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:0e30470d12e11f473750e0b95833d0d1fe6fd3ee9d9d0c5d7454614449156148_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:2324eeab4219c1c953b698cbd1cf57e0af777f31042de00eaaa2bf163f84cae1_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:c3d60eaf9f775e623114d093450b5d170b4048ef1e52267a2153ec54489bd00f_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-backup-rhel8-operator@sha256:9969b8f2f91bd0a3ef0e89300d66a656238a3a3361d56cf7fc0eb55db1752782_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-backup-rhel8-operator@sha256:d5639931ddcb1288f279f54a3688fcb8c94d710a457917c46bfa3db6cd1a317b_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-backup-rhel8-operator@sha256:fa4667d27a8778efc83ace86657c638aacb7ccc3168c489d427c1d6ab834cbb2_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • +170 more not shown

✅ Remediation

For Red Hat Advanced Cluster Management for Kubernetes, see the following documentation, which will be updated shortly for this release, for important instructions on installing this update: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html-single/install/index#installing Workaround: By default, this vulnerability is not exploitable. In order to make sure this is mitigated, do not enable redirections, i.e.: `maxRedirections: 0` Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (17)