RHSA-2023:0693MediumCVSS 7.8

Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.7 security and bug fix update

Published
February 9, 2023
Last Modified
August 19, 2026

🔗 CVE IDs covered (9)

CVE-2022-32149 →CVE-2022-32189 →CVE-2022-41715 →CVE-2021-43138 →CVE-2022-2879 →CVE-2022-2880 →CVE-2022-27664 →CVE-2022-32190 →CVE-2022-41717 →

📋 Description

CVE-2021-43138 — async: Prototype Pollution in async CVE-2022-2879 — golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers CVE-2022-2880 — golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters CVE-2022-27664 — golang: net/http: handle server errors after sending GOAWAY CVE-2022-32149 — golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags CVE-2022-32189 — golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service CVE-2022-32190 — golang: net/url: JoinPath does not strip relative path components in all circumstances CVE-2022-41715 — golang: regexp/syntax: limit memory used by parsing regexps CVE-2022-41717 — golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests

🎯 Affected products18

  • 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-controller-rhel8@sha256:362eb32d0d2607f72b4f425dabaea7cde5d292ac41aea0c18c78bc6e408fff9e_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-hook-runner-rhel8@sha256:aa63717ac3a4961e774ed0baa3a73f01eda185516e7380579d97b9d25764d10d_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-legacy-rhel8-operator@sha256:1ac9cdfbdce8f7b6e4ebf5e40013f766b71b6dd604c92f602aca96612a228eda_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-log-reader-rhel8@sha256:d89e9ef65993466d25b26702d0210c14ce191155501774f4d2f1f08dbdad9804_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-must-gather-rhel8@sha256:5acf34dc4041b694b452d46c2f656db566241773285ca305a79ab7b9dc087b43_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-openvpn-rhel8@sha256:15df7304827ce49d422554551f08d99cfffa1afc4ffacac145d4399ccb1cbd68_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-operator-bundle@sha256:90ed03a5e0cb0b0ffd85f7434cc4eda9bd8fe81cd90b597772d9b7caccd4b80f_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-registry-rhel8@sha256:aaa03ef0769d38185675db2a7a78454659de14bdebe5ff842614bf2124e5adfe_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-rhel8-operator@sha256:aaaf4f6095294b497889749390f0a3aac04b83131a423799c44b5e367e0b370a_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:58bd4ffc3e9599401251ac929cf15c1773ecc03a57177118adbe23ac8d7762af_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-ui-rhel8@sha256:4141db5099ae659270297eb4aaff695ac43fce67d91fea49dbc76583f419d3a1_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-plugin-for-aws-rhel8@sha256:633eeb0b6b50e21bbc0fb12fd2262294733fc9ac8b1e9eedcdb9d1433534d88d_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8@sha256:19dbf2bb83f8a0f35079d6ae25f8fcddad970e48ecb21694fd2d4c553313e4aa_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8@sha256:93e95f065eadaa41154b9012dd5ddc824607758e2bce85c4256c2689125b80a4_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-restic-restore-helper-rhel8@sha256:70d3d46f54b91538e047df62e7e5b161fabac195a2f2e45cdba78215b4c82a7d_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-rhel8@sha256:1ca6945c3918f1743a4cee86a507f9f6581c8f8e572b6b8739d79a675a64d1db_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-velero-plugin-rhel8@sha256:26f8fb5c41ece82626325ba502505ba1ca7986602cc147b492f9857caa0be868_amd64 as a component of 8Base-RHMTC-1.7

✅ Remediation

For details on how to install and use MTC, refer to: https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (15)