RHSA-2023:3205MediumCVSS 7.5

Red Hat Security Advisory: OpenShift Virtualization 4.13.0 Images security, bug fix, and enhancement update

Published
May 18, 2023
Last Modified
August 19, 2026

🔗 CVE IDs covered (8)

CVE-2022-32190 →CVE-2022-41715 →CVE-2022-41717 →CVE-2022-2879 →CVE-2022-2880 →CVE-2022-27664 →CVE-2022-32149 →CVE-2022-32189 →

📋 Description

CVE-2022-2879 — golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers CVE-2022-2880 — golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters CVE-2022-27664 — golang: net/http: handle server errors after sending GOAWAY CVE-2022-32149 — golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags CVE-2022-32189 — golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service CVE-2022-32190 — golang: net/url: JoinPath does not strip relative path components in all circumstances CVE-2022-41715 — golang: regexp/syntax: limit memory used by parsing regexps CVE-2022-41717 — golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests

🎯 Affected products93

  • CNV 4.13 for RHEL 9
  • container-native-virtualization/bridge-marker-rhel9@sha256:8eac196b30a648989cdca5cb153a3bc3d34e47339acba0e4f760bd366496c99d_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/bridge-marker-rhel9@sha256:e8a55aee3d75a316bb0d7a554c737198823df04b3c05e481c17e45eb2153bced_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:3bff33e3f40cd1e2b519c2db56734d4bb8df883e155c2f20b1cb9d3d184daec1_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:f439d2f420bb59eb1d5af14ce2002648d0cfc155d1a1466c8aac9b661fe902b8_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:89f22e541f61a660c9aa9f38ef58e80b84a0517f74e84292107fc252c25465c9_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:bf471997e54e4a75b0d71f492ab295787fdbb14d8c85c4ea8c03f0552dbc3755_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/cnv-must-gather-rhel9@sha256:9e8efd76924958eb605401abdac08eba97fb83a1ada383bc87a7fb7c87b3a455_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/cnv-must-gather-rhel9@sha256:b9fc32b5fabedd65a4c3a471879c808af2087277de4278adaa115a732f0468da_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/hco-bundle-registry-rhel9@sha256:60e89d7a99ff9f20e974430b802dd724a3bb6fa1e01e5a62daad98ac487b3063_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/hco-bundle-registry-rhel9@sha256:dd20b138045ef1424d83a47e7abcfcbb2ac54577dcec5ed3c186390aaa4c9d84_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/hostpath-csi-driver-rhel9@sha256:61e2824853d51347593ad909a5e546cd92e4216d6a1df5dffb50dd9cba277cce_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/hostpath-csi-driver-rhel9@sha256:676d4c23a5f60dd331728af056b0a6b2d3358ac88da23299b1a98dfaca8f288e_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-operator-rhel9@sha256:515be94be496c67f5b8fd5f4832fe4385e56476e6589897d6b9fbb9bb2b00f32_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-operator-rhel9@sha256:571ae805641dea11646028c946039983c7fd82f138b915dcb8b80c39b465e63c_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-rhel9@sha256:ac3fe350bedd6bc43596444ba0f279ccf8a144ab14ac5a9b80ea71c46390b7b4_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-rhel9@sha256:d4ed87745b7ee2acca2d83e2c91c2f6dced1903c81495b50f2559b3ba2dde287_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/hyperconverged-cluster-operator-rhel9@sha256:e5ab9f3be59d3568e3d672ab374efb16990ccf92192eac4e1244b10fcd7423e2_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/hyperconverged-cluster-operator-rhel9@sha256:e681560b184189df03fc84c8a712f32289f42573dd348cda394b19565eb6eca8_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/hyperconverged-cluster-webhook-rhel9@sha256:06d036d320b3027bb8370bb8e0f6fe8c9f0ec9bca7aac3b5c53698ba4a170042_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/hyperconverged-cluster-webhook-rhel9@sha256:b5a01336180aad017df62cf8e652f2491b8263ba7e4dd07f858db1ef1924cf2f_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/kubemacpool-rhel9@sha256:4d190d81eeb3fbe9ed56cf3548dc83a3f81641bfdafa7b42dcfb0d2512566644_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/kubemacpool-rhel9@sha256:59862a59854f0d5b83dc25ba119f9586a8aff42b6e60d1922f8ae7b4567309ff_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/kubesecondarydns-rhel9@sha256:121d30d78cc57731ea2242ef2c32430890ac66c2723e65608d5e2f26c3f515cd_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/kubesecondarydns-rhel9@sha256:b1838f3c8ba3d8113bddea17b78c21e1c1490e2a4a07ea77014edee523d06347_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:86a4b1e3d6ad1d56302c9c058f8bc5826dcfe6c46fb3e0ddaa06818645039020_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ffb2acd9ae09c1ef9ca756f5eaf6087d0a3957cfc824543949d25f556a97744d_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/kubevirt-dpdk-checkup-rhel9@sha256:525aceb9396010ebcdba14040f267889b807cd84db8e5b4030429b51f0fbf5fe_arm64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/kubevirt-dpdk-checkup-rhel9@sha256:553c4686f56c66cc1e3c5ad9d4051f139d43f821eac3abb98ca5cdb8b5dfe202_amd64 as a component of CNV 4.13 for RHEL 9
  • container-native-virtualization/kubevirt-ssp-operator-rhel9@sha256:901e6cad9534c7bd7c4018c60bccfe49d7280fba5a9901ab4c4d15e9345288c4_amd64 as a component of CNV 4.13 for RHEL 9
  • +63 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (211)