RHSA-2022:7399MediumCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.0 bug fix and security update

Published
January 17, 2023
Last Modified
August 7, 2026

🔗 CVE IDs covered (10)

CVE-2022-2880 →CVE-2022-21698 →CVE-2022-41715 →CVE-2023-0296 →CVE-2022-2879 →CVE-2022-32148 →CVE-2022-32190 →CVE-2022-41316 →CVE-2021-38561 →CVE-2022-1705 →

📋 Description

CVE-2021-38561 — golang: out-of-bounds read in golang.org/x/text/language leads to DoS CVE-2022-1705 — golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-2879 — golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers CVE-2022-2880 — golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters CVE-2022-21698 — prometheus/client_golang: Denial of service using InstrumentHandlerCounter CVE-2022-32148 — golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working CVE-2022-32190 — golang: net/url: JoinPath does not strip relative path components in all circumstances CVE-2022-41316 — vault: insufficient certificate revocation list checking CVE-2022-41715 — golang: regexp/syntax: limit memory used by parsing regexps CVE-2023-0296 — openshift: etcd grpc-proxy vulnerable to The Birthday attack against 64-bit block cipher

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:34bfcdd0c6302a0f877a4257054302fa4f8a0549209b09d9d4c0bd8007cac9f2_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:397d151ca1aae56133956631774fe12bfb9afc0b056ccd14f2bb38892bcd4788_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:76b1c9d7a661f38cb46d6c98c549f69f45b4fa70e5365209e8d588bf63cddd46_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:a2835234bba16a0f5aa264ffc5cd6522987568ee5e73b2c6f281d71a9ccefdee_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:39a30f0a0bbcfa7fb0aa97b00034f95d85cda401b6a093074bf8db350be89b6a_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:8b8daee59b113574d990e5750a53ca6a4dec276cd41ace50e3d3d822b40eba1c_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:b00015311a18a1e2a6efe6bebcf7bfddfdd9f64e07391020895bca213cf4d9f1_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:b53883ca2bac5925857148c4a1abc300ced96c222498e3bc134fe7ce3a1dd404_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:7310131b141ca567d014784d729757eef23c9ec3324fdb43ee18d126309497cf_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:8bbff909b5bd914b9aef6c2ceea0279cb787aba86c0f85f74af43ebe7adc8ff0_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:cad5a85f21da1d2e653f41f82db607ab6827da0468283f63694c509e39374f0d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:e5569fab4490324f24195d25e306f9bc0a329d09d3a615c77efa540c08fe3bb1_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:277a548af183f96447f5ff39340f81a5db71976e4ddbc3c0b6d552bda6876933_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:7959d1268ec98c7d05cb1153eb109d788a33f55aa8e74301d9893a258452099e_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:a9c6e29a6653384fc859a34273f34dbb38a62a06676196767700d54b1c962b68_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:be850306750476202babef4373b0eb4f1d1c79d09ac5e46c6e5d523231b220ae_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:53965f0708a1e57d4fd62d058d9159ab3405ce121a00e69e0f630d671b7789b7_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:576dc999accc8af51337f797e57adde3a6488c3e61d6f9fb9a397a26786ab905_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:78c082bce19429174ebd5582565c23c1ff0c7e98a73aeb62b2a4083ea292a2d3_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:c21be50b021f0d8580307fb8c10667da00833295dac342affa834ee159b29ffe_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/oc-mirror-plugin-rhel8@sha256:9434f74409e1b349f5b9c088b6c831089010e4ed2fa027ff3f035e773ab495fb_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:20b771d3a62c96c479df3e7c5936cfa100c4c17c98b9a8f5f9a56b7e891f8f90_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:4ceeb4bc41276732266554ab353c35e379b993728a40cc207b89ac1a5d16d2b2_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:7c23b71619bd88c1bfa093cfa1a72db148937e8f1637c99ff164bf566eaf78b8_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:d17688b307727063dff085889029503c99bb649393c0a3430d7397e0261f2176_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:353ef1e66352e3dd33873bba0042097d6fa34cfda32015589fd04529f73c17bc_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:9e4bb74202f1fc1d26dc89345c81a21bd3fe6c1491b2d24fa2f62e5c8cd16d04_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:dd1e2e0c92a1eac0d366628e27aaac490a7f5702e8d905b86b6c53d850734ef3_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:f30638f60452062aba36a26ee6c036feead2f03b28f2c47f2b0a991e4182331e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +170 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags The sha values for the release are: (For x86_64 architecture) The image digest is sha256:4c5a7e26d707780be6466ddc9591865beb2e3baa5556432d23e8d57966a2dd18 (For s390x architecture) The image digest is sha256:ab70750be4fadf5a525141ae32a8577c91dd19f1d6e582a6824339c938216ec0 (For ppc64le architecture) The image digest is sha256:5a5943dea60b40f73ecee685b12fff1d65cc8bfe946f762fdfe862969483ddbb (For aarch64 architecture) The image digest is sha256:cb34667519d1cfd8eedf0fb27e14b7b7e6209323b86977bfaadf91da012d179d All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

🔗 References (951)