Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 441
Alerts This Week
Warning Icon 1 441

Red Hat: RHSA-2022:7055 Moderate: Security Update for OpenShift 2.6.0

red hat
Calendar Grey October 19, 2022
Dist Redhat Esm H88
The release of Red Hat OpenShift version 2.6.0 includes a significant security enhancement aimed at resolving vulnerabilities found in both operator and operand containers.
An update is now available for Red Hat Openshift distributed tracing 2.6.0 Red Hat Product Security has rated this update as having a security impact of Moderate

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

This release of Red Hat OpenShift distributed tracing provides these changes:
Security Fix(es):
* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)
* eventsource: Exposure of Sensitive Information (CVE-2022-1650)
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
* follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536)
* Moment.js: Path traversal in moment.locale (CVE-2022-24785)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory security issue Red Hat moderate severity operator container distributed tracing

References

https://access.redhat.com/security/cve/CVE-2015-20107 https://access.redhat.com/security/cve/CVE-2021-3918 https://access.redhat.com/security/cve/CVE-2022-0391 https://access.redhat.com/security/cve/CVE-2022-0536 https://access.redhat.com/security/cve/CVE-2022-1292 https://access.redhat.com/security/cve/CVE-2022-1586 https://access.redhat.com/security/cve/CVE-2022-1650 https://access.redhat.com/security/cve/CVE-2022-1785 https://access.redhat.com/security/cve/CVE-2022-1897 https://access.redhat.com/security/cve/CVE-2022-1927 https://access.redhat.com/security/cve/CVE-2022-2068 https://access.redhat.com/security/cve/CVE-2022-2097 https://access.redhat.com/security/cve/CVE-2022-24785 https://access.redhat.com/security/cve/CVE-2022-31129 https://access.redhat.com/security/cve/CVE-2022-32206 https://access.redhat.com/security/cve/CVE-2022-32208 https://access.redhat.com/security/cve/CVE-2022-34903 https://access.redhat.com/security/updates/classification#moderate

Package List


Advisory ID: RHSA-2022:7055-01
Product: RHOSDT
Advisory URL: https://access.redhat.com/errata/RHSA-2022:7055
Issue date: 2022-10-19

Topic

An update is now available for Red Hat Openshift distributed tracing 2.6.0Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security issue Red Hat moderate severity operator container distributed tracing

Relevant Releases Architectures

Bugs Fixed

2024702 - CVE-2021-3918 nodejs-json-schema: Prototype pollution vulnerability

2053259 - CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak

2072009 - CVE-2022-24785 Moment.js: Path traversal in moment.locale

2085307 - CVE-2022-1650 eventsource: Exposure of Sensitive Information

2105075 - CVE-2022-31129 moment: inefficient parsing algorithm resulting in DoS

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.