RHSA-2022:6348: Moderate: Gatekeeper Operator v0.2 security and container updates
Gatekeeper Operator v0.2Gatekeeper is an open source project that applies the OPA ConstraintFramework to enforce policies on your Kubernetes clusters. This advisory contains the container images for Gatekeeper that include bugfixes and container upgrades. Note: Gatekeeper support from the Red Hat support team is limited to where it is integrated and used with Red Hat Advanced Cluster Managementfor Kubernetes. For support options for any other use, see the Gatekeeperopen source project website at:https://open-policy-agent.github.io/gatekeeper/website/docs/howto/. Security fix: CVE-2022-30629: gatekeeper-container: golang: crypto/tls: session tickets lack random ticketageadd CVE-2022-1705: golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1962: golang: go/parser: stack exhaustion in all Parse functions CVE-2022-28131: golang: encoding/xml: stack exhaustion in Decoder.Skip CVE-2022-30630: golang: io/fs: stack exhaustion in Glob CVE-2022-30631: golang: compress/gzip: stack exhaustion in Reader.Read CVE-2022-30632: golang: path/filepath: stack exhaustion in Glob CVE-2022-30635: golang: encoding/gob: stack exhaustion in Decoder.Decode CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:6348?
The severity of RHSA-2022:6348 is classified as critical due to vulnerabilities that can lead to potential exploits in Kubernetes clusters.
How do I fix RHSA-2022:6348?
To fix RHSA-2022:6348, you should upgrade to the latest container images provided in the advisory.
Which versions of Gatekeeper are affected by RHSA-2022:6348?
RHSA-2022:6348 affects versions of Gatekeeper prior to v0.2 that contain the identified vulnerabilities.
What vulnerabilities does RHSA-2022:6348 address?
RHSA-2022:6348 addresses multiple vulnerabilities related to policy enforcement in Kubernetes using Gatekeeper.
Is there a workaround for RHSA-2022:6348?
There are no recommended workarounds for RHSA-2022:6348; upgrading is the advised course of action.