RHSA-2023:1042MediumCVSS 7.5

Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift (with security updates)

Published
March 6, 2023
Last Modified
August 24, 2026

🔗 CVE IDs covered (15)

CVE-2022-1962 →CVE-2022-1705 →CVE-2022-2879 →CVE-2022-2880 →CVE-2022-30631 →CVE-2022-30632 →CVE-2022-30633 →CVE-2022-32148 →CVE-2022-32149 →CVE-2022-27664 →CVE-2022-30630 →CVE-2022-30635 →CVE-2022-41715 →CVE-2022-28131 →CVE-2022-28327 →

📋 Description

CVE-2022-1705 — golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1962 — golang: go/parser: stack exhaustion in all Parse* functions CVE-2022-2879 — golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers CVE-2022-2880 — golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters CVE-2022-27664 — golang: net/http: handle server errors after sending GOAWAY CVE-2022-28131 — golang: encoding/xml: stack exhaustion in Decoder.Skip CVE-2022-28327 — golang: crypto/elliptic: panic caused by oversized scalar CVE-2022-30630 — golang: io/fs: stack exhaustion in Glob CVE-2022-30631 — golang: compress/gzip: stack exhaustion in Reader.Read CVE-2022-30632 — golang: path/filepath: stack exhaustion in Glob CVE-2022-30633 — golang: encoding/xml: stack exhaustion in Unmarshal CVE-2022-30635 — golang: encoding/gob: stack exhaustion in Decoder.Decode CVE-2022-32148 — golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working CVE-2022-32149 — golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags CVE-2022-41715 — golang: regexp/syntax: limit memory used by parsing regexps

🎯 Affected products5

  • OpenShift Custom Metrics Autoscaler 2
  • custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8@sha256:c79cb3c68317a224277a8ee0dc78832fcd4b6da18b9b5b074cffaad14e2f1aa5_amd64 as a component of OpenShift Custom Metrics Autoscaler 2
  • custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-operator-bundle@sha256:44de4b736089166718956bebd456ad1a17e0e6f72c49f52804c6b6e60ef5a494_amd64 as a component of OpenShift Custom Metrics Autoscaler 2
  • custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator@sha256:5a149d0a0cdb6812acbef0c9b3031fb3cd84181e971198a6e17d8fd0bf5e6293_amd64 as a component of OpenShift Custom Metrics Autoscaler 2
  • custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8@sha256:a403d057cd2ca820306207282007d4d117623e1a2ebb8bee67c19f5796f07f95_amd64 as a component of OpenShift Custom Metrics Autoscaler 2

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

🔗 References (22)