RHSA-2023:1275HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenStack Platform (etcd) security update

Published
March 15, 2023
Last Modified
August 6, 2026

🔗 CVE IDs covered (12)

CVE-2022-2880 →CVE-2022-3064 →CVE-2022-30630 →CVE-2022-30632 →CVE-2022-30635 →CVE-2022-32148 →CVE-2022-41715 →CVE-2022-1705 →CVE-2022-27664 →CVE-2022-30629 →CVE-2022-32189 →CVE-2022-41717 →

📋 Description

CVE-2022-1705 — golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-2880 — golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters CVE-2022-3064 — go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents CVE-2022-27664 — golang: net/http: handle server errors after sending GOAWAY CVE-2022-30629 — golang: crypto/tls: session tickets lack random ticket_age_add CVE-2022-30630 — golang: io/fs: stack exhaustion in Glob CVE-2022-30632 — golang: path/filepath: stack exhaustion in Glob CVE-2022-30635 — golang: encoding/gob: stack exhaustion in Decoder.Decode CVE-2022-32148 — golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working CVE-2022-32189 — golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service CVE-2022-41715 — golang: regexp/syntax: limit memory used by parsing regexps CVE-2022-41717 — golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests

🎯 Affected products16

  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • etcd-0:3.3.23-12.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.1
  • etcd-0:3.3.23-12.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • etcd-0:3.3.23-12.el8ost.src as a component of Red Hat OpenStack Platform 16.1
  • etcd-0:3.3.23-12.el8ost.src as a component of Red Hat OpenStack Platform 16.2
  • etcd-0:3.3.23-12.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.1
  • etcd-0:3.3.23-12.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • etcd-debuginfo-0:3.3.23-12.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.1
  • etcd-debuginfo-0:3.3.23-12.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • etcd-debuginfo-0:3.3.23-12.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.1
  • etcd-debuginfo-0:3.3.23-12.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2
  • etcd-debugsource-0:3.3.23-12.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.1
  • etcd-debugsource-0:3.3.23-12.el8ost.ppc64le as a component of Red Hat OpenStack Platform 16.2
  • etcd-debugsource-0:3.3.23-12.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.1
  • etcd-debugsource-0:3.3.23-12.el8ost.x86_64 as a component of Red Hat OpenStack Platform 16.2

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (15)