RHSA-2022:7276MediumCVSS 7.5

Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.8 security fixes and container updates

Published
November 1, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (5)

CVE-2022-25858 →CVE-2022-31129 →CVE-2022-35948 →CVE-2022-35949 →CVE-2022-2238 →

📋 Description

CVE-2022-2238 — search-api: SQL injection leads to remote denial of service CVE-2022-25858 — terser: insecure use of regular expressions leads to ReDoS CVE-2022-31129 — moment: inefficient parsing algorithm resulting in DoS CVE-2022-35948 — nodejs: undici vulnerable to CRLF via content headers CVE-2022-35949 — nodejs: undici.request vulnerable to SSRF

🎯 Affected products200

  • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:32c9fc3270f92f52be7a3d6479cdca9627c4b2be5f37a4ffb5854547558d01f8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:8ae58edede22501d2651155da21fe094ce1997db8d8c7ee260585d022bab978c_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:d947f131cf3527bee24fde95e9578eda977272379a1b9b25bbffced0b7ab7265_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:10f91c9e714089b291330d879bd6f08531eb5e567c20e5b40dfe8effe8fcd6a2_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:4907fefef6d2427d07962aae5169792f65d1fd8f3f3c429601eb12c0fdb33dd9_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:82af465c0a9a6ddcee4b6f783220713883168d893a5c30e3d20ecdd1f7bd9212_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:00a4bbaf666fc9e26859459a2ce30b92e02aa93c9873904f6d1177f135c369c0_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:4e94fc7c80275f1b8f493a7cbbab5a9f39f8a7e031c1b6680862bc6bff0cab09_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:c8f64cdaf49247d26449e5012a0b9d6bcb3ccce53a2881c92a05f0de8306d343_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/agent-service-rhel8@sha256:7310607371b23fd401dd11a4d8f169cef64334a98791ee681a8e51dc4aa40bd3_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/agent-service-rhel8@sha256:ae7845898166d8cdcfe2f49d9c4200aaa0a448f8327c1d9568a18b2640c04603_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/agent-service-rhel8@sha256:d9c728866e1157b778230104de59f23a259defb918b3f414c6278ec9e95d342e_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/application-ui-rhel8@sha256:2f1b3dc0f1d9283f24b6f898afda438d132e983df4442b8929d4a396083474dc_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/application-ui-rhel8@sha256:b444dc2df0d109616ea92fd6b321ebddb7f8063e88e771419103433002f385e2_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/application-ui-rhel8@sha256:dd107ca4320aee4d2013d87122aa31714a4b3501118ad492e3ee3822006e562c_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-image-service-rhel8@sha256:0ed96b5d322932db657a64014496c1f1563de9f21f049becd59b86d976caccec_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-image-service-rhel8@sha256:7dbf8df5f88923a7db313f88c58e3c5e89437c5960b6f799cdfc84464ee9cffd_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-image-service-rhel8@sha256:ed2204b626cbb894e65c1fda7b586fd30f549317b01373760bd8658d1ee340e8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-agent-rhel8@sha256:052b87af33c5dd5592f6db7b201e659ccf28e032c694dc79980895d1c35a15b0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-reporter-rhel8@sha256:07186a9834372812fa53960b64389fbb3fe38bf26c9afaa962600250be8f4e5d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-reporter-rhel8@sha256:6770b5d671bfc7dacf9530357e8009d3536bf9a3b5138adfca7a514433f7bf2d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-rhel8@sha256:32d927f22fbc42c1dca7875d3e757bcf30fa70f52810eebc94a406e54a80fb48_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-rhel8@sha256:c425f828749fd87ba2d7c3895ecd97b75c0266158de71d2ae4ad80b886eb8e19_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:01ab599a419096a0552709adf5358e76265a1b638839ca049b6bcd13c9bc98ea_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:c1e1092e74ec93df9b34e5d625305ebf7992a9fc574e083697f482555eae5d4c_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:d533bcea3145211d2aa43eb8c445d16d281684c9f56b32be0acc7dc91887668a_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-backup-rhel8-operator@sha256:1226ade84292cd94ded87275fab0541f9951b18b1237581c9d7a0548f14d1e43_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-backup-rhel8-operator@sha256:821b1abfe1bdec20194a8dce46dfce6e55c6afd02dc061f41d0ad408759204a5_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-backup-rhel8-operator@sha256:cb0559f03e1c60c31e77376a3b936cb8a35ad6144841549018e5ba274ecd7933_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • +170 more not shown

✅ Remediation

For Red Hat Advanced Cluster Management for Kubernetes, see the following documentation, which will be updated shortly for this release, for important instructions on installing this update: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html-single/install/index#installing Workaround: A possible mitigation is to sanitize user input when sending content-type headers. Workaround: Validate user input before passing it to the `undici.request` call.

🔗 References (9)