SB20221019101 - Multiple vulnerabilities in OpenShift Container Platform 4.9
Published: October 19, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) OS Command Injection (CVE-ID: CVE-2022-26945)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Input validation error (CVE-ID: CVE-2022-30321)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an unspecified error. A remote attacker can perform a denial of service (DoS) attack.
3) Input validation error (CVE-ID: CVE-2022-30322)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an unspecified error. A remote attacker can perform a denial of service (DoS) attack.
4) Input validation error (CVE-ID: CVE-2022-30323)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an unspecified error. A remote attacker can perform a denial of service (DoS) attack.
5) Memory leak (CVE-ID: CVE-2022-38177)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in the DNSSEC verification code for the ECDSA algorithm. A remote attacker can spoof the target resolver with responses that have a malformed ECDSA signature and perform denial of service attack.
6) Memory leak (CVE-ID: CVE-2022-38178)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in the DNSSEC verification code for the EdDSA algorithm. A remote attacker can spoof the target resolver with responses that have a malformed EdDSA signature and perform denial of service attack.
7) Use-after-free (CVE-ID: CVE-2022-40674)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the doContent() function in xmlparse.c. A remote attacker can pass specially crafted input to the application that is using the affected library, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Remediation
Install update from vendor's website.