RHSA-2022:0318: Moderate: Red Hat OpenShift distributed tracing 2.1.0 security update
Release of Red Hat OpenShift distributed Tracing provides these changes:Security Fix(es): golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet (CVE-2021-29923) golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.The Red Hat OpenShift distributed tracing release notes provide information onthe features and known issues:https://docs.openshift.com/container-platform/latest/distrtracing/distributed-tracing-release-notes.html
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:0318?
The severity of RHSA-2022:0318 is considered to be significant due to the potential impact on applications using the affected Golang libraries.
How do I fix RHSA-2022:0318?
To fix RHSA-2022:0318, you should update your Red Hat OpenShift tracing components to the latest patched version provided in the advisory.
What vulnerabilities are addressed in RHSA-2022:0318?
RHSA-2022:0318 addresses vulnerabilities related to incorrect parsing of IP addresses and a panic scenario due to race conditions in Golang.
Which versions of Red Hat OpenShift are affected by RHSA-2022:0318?
RHSA-2022:0318 affects specific versions of Red Hat OpenShift that utilize the vulnerable Golang libraries.
Is there any workaround for RHSA-2022:0318?
There are no recommended workarounds for RHSA-2022:0318; applying the latest updates is the advised course of action.