RHSA-2022:8535MediumCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.11.16 security update

Published
November 24, 2022
Last Modified
September 30, 2026

🔗 CVE IDs covered (5)

CVE-2022-2879 →CVE-2022-2880 →CVE-2022-27664 →CVE-2022-32189 →CVE-2022-41715 →

📋 Description

CVE-2022-2879 — golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers CVE-2022-2880 — golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters CVE-2022-27664 — golang: net/http: handle server errors after sending GOAWAY CVE-2022-32189 — golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service CVE-2022-41715 — golang: regexp/syntax: limit memory used by parsing regexps

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:0684e5ff592cecda516af7af1e30a70d25263c7d1706887616f0880b8fad5fd8_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:6544c6c4b0ab51e8ed633a9d708ec7fe88dd627dd5b61ab6aa0251955f6d1ad8_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:8a3595cfab92bf0f745c9365dc66664b8f668b9adc1cbdfb86ac6edc96e4e7fd_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:c3032fc3a208198e9bbe3a4fac8baadfa4101ec007a15b0470957d0d2fd57094_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:11e9fb1a75d81da0813e2af5b5d95752e46f87eaa70ddd602b92d0aa9948ea95_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:1291f91ad981a9cad040c9fdbef48357aff74900995925e1c3bcd32e178a0a32_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:5dab4283b85f41462e14cd499730adb42fdde0a38291012734c6414969794d7a_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:93e31503023e33e9379b14adfaa0e47e04194a9bf5fb8f84e7e931cd1586a9ff_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:01b7a7cc97e9e874aa7244b77f27da7e4b5eb662fd7974c07f9fd7fb3f8a9e11_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:247cabb1f1782c7601e53eb7ef3eacf1f3c021ff2554c75d79494923463d001c_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:78c5514dc958562063675eecaf4b95ea6de25d86bdc54a8487985659a2039c8e_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:8adaa53f43c5257d1d4a02f2b880bd63430908f2286bc97f323f42a7cf9166bd_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:14d506c97172315fa6bfb2d6f13bc2bf6190a92a998f4481b170e8445ffc14be_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:58579772fe619f89914cd4f377ae2cf217a77835665892a40ed10a0b194a6b7b_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:9767fa150cf1afa1d55e0d3da00afb67ccc5a3b4f504dd0d014ef87093e9e840_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:ad51e34146fc504aafa202ad231dd63e67dc4e31f037131b3b535969a96ce9a3_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/oc-mirror-plugin-rhel8@sha256:7561aaf5ab781af462b1865e58aa2457b3017cf9dfe6e70d7822028be6fe9f7a_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:538b5bae98172ee1ed30082d350439c41a288e4d6eddd57019aa3f5b1bbe8d42_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:9ab909cc1fa8be000a2fa8a3851aa75d8d6054180de2833591d779a61e7327fd_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:d4aa9db946ec75dba7691b89d70517b307b889903e67890cf1ec5a463698b939_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:f7730ef576bb14c7f0e7191a07152eac21c103492c1787ba8f43c09f9b04cfdb_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:2b0ff7c9a3525640aca57c1ad3aa1f4af5c8cff3ab3e50c52c693bf3f53e9148_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:588b2ea5e99f02af2549e5c9cbab49f6c5d90a5654f971a55bbff579899f0a17_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:bb63f329aa6e368745a7b2d27f9847afcdeb11edb25072a7b96778dfce74c1ca_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:c9cc6b6572a9ae2d6cf4de3d602703f3a9af72a0e21e2c3556c811ea7fecc622_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:7316bb76b96f7feb3826ea0d999267981d4b7c44032d6e43c92ef87f84c669e4_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:b0c56b2f556a7b084fb7d34ae0d4c684775ce0d915b7c2c33f1869b382ffce88_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:e2b9afbfeb5eb1a6c224a549148a3203c5bb114c2df4e8ba4a4658e8c2996df5_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:fa9008cca62fa030f038fd0e696c92af79e0772d0f0df3ce55f1d5047b3c17c5_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags The sha values for the release are: (For x86_64 architecture) The image digest is sha256:01c9ef7f802f0ba254847c22e960cd6453ed9f61d9296fdda8bd497712f53e23 (For s390x architecture) The image digest is sha256:8e2adb075d0666881cbd360c679d9fdc893e797c64480bca8db50956a415105e (For ppc64le architecture) The image digest is sha256:598ace9ac33904216a9506d81f6dd7d56e7ca66a7d849e43cb58304f8eb738ef (For aarch64 architecture) The image digest is sha256:e4bb06fe2b63bf2776e529d97202ae7615bdee9811ce10a737052c11d8cd7e83 All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (14)