RHSA-2022:2183: Moderate: Release of containers for OSP 16.2.z director operator tech preview
Release osp-director-operator imagesSecurity Fix(es): golang: kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote (CVE-2019-11253) golang: golang-github-miekg-dns: predictable TXID can lead to response forgeries (CVE-2019-19794) golang: containerd: unrestricted access to abstract Unix domain socket can lead to privileges (CVE-2020-15257) golang: ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482) golang: containerd: pulling and extracting crafted container image may result in Unix file permission changes (CVE-2021-32760) For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:2183?
The severity of RHSA-2022:2183 is considered important due to vulnerabilities that could lead to remote code execution.
How do I fix RHSA-2022:2183?
To fix RHSA-2022:2183, update your golang and golang-github-miekg-dns packages to the latest patched versions.
What vulnerabilities are addressed in RHSA-2022:2183?
RHSA-2022:2183 addresses CVE-2019-11253, which is related to YAML parsing vulnerabilities, and CVE-2019-19794, concerning predictable TXID leading to response forgeries.
Is RHSA-2022:2183 applicable to all users?
RHSA-2022:2183 is applicable to users of the affected golang components, specifically those using vulnerable versions.
What are the risks if RHSA-2022:2183 is not remediated?
If RHSA-2022:2183 is not remediated, systems may become susceptible to remote attacks that exploit these vulnerabilities.