RHSA-2022:6277: Moderate: Red Hat OpenShift Service Mesh 2.1.5 security update
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.This advisory covers the RPM packages for the release.Security Fix(es): moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129) golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675) moment: Moment.js: Path traversal in moment.locale (CVE-2022-24785) golang: regexp: stack exhaustion via a deeply nested expression (CVE-2022-24921) golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327) golang: syscall: faccessat checks wrong group (CVE-2022-29526) golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:6277?
The severity of RHSA-2022:6277 is considered critical.
How do I fix RHSA-2022:6277?
To fix RHSA-2022:6277, you should update the affected packages to their fixed versions as specified in the advisory.
What affected packages are listed in RHSA-2022:6277?
RHSA-2022:6277 affects several packages including servicemesh, servicemesh-operator, servicemesh-prometheus, and servicemesh-proxy among others.
Is RHSA-2022:6277 related to any specific vulnerabilities?
Yes, RHSA-2022:6277 addresses vulnerabilities related to inefficient parsing in the moment library.
Which versions of the packages are remedied in RHSA-2022:6277?
The remedied package versions in RHSA-2022:6277 include servicemesh 2.1.5-1.el8 and servicemesh-prometheus 2.23.0-9.el8.