Sign-up

ID

VAR-202202-0050


CVE

CVE-2022-25235


TITLE

Expat  Encoding and escaping vulnerabilities in

Trust: 0.8

sources: JVNDB: JVNDB-2022-003475

DESCRIPTION

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. Expat ( alias libexpat) Exists in encoding and escaping vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Summary: The Migration Toolkit for Containers (MTC) 1.7.1 is now available. Description: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Bugs fixed (https://bugzilla.redhat.com/): 2020725 - CVE-2021-41771 golang: debug/macho: invalid dynamic symbol table command can cause panic 2020736 - CVE-2021-41772 golang: archive/zip: Reader.Open panics on empty string 2024938 - CVE-2021-41190 opencontainers: OCI manifest and index parsing confusion 2030801 - CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache 2030806 - CVE-2021-44717 golang: syscall: don't close fd 0 on ForkExec error 2040378 - Don't allow Storage class conversion migration if source cluster has only one storage class defined [backend] 2057516 - [MTC UI] UI should not allow PVC mapping for Full migration 2060244 - [MTC] DIM registry route need to be exposed to create inter-cluster state migration plans 2060717 - [MTC] Registry pod goes in CrashLoopBackOff several times when MCG Nooba is used as the Replication Repository 2061347 - [MTC] Log reader pod is missing velero and restic pod logs. 2061653 - [MTC UI] Migration Resources section showing pods from other namespaces 2062682 - [MTC] Destination storage class non-availability warning visible in Intra-cluster source to source state-migration migplan. 2065837 - controller_config.yml.j2 merge type should be set to merge (currently using the default strategic) 2071000 - Storage Conversion: UI doesn't have the ability to skip PVC 2072036 - Migration plan for storage conversion cannot be created if there's no replication repository 2072186 - Wrong migration type description 2072684 - Storage Conversion: PersistentVolumeClaimTemplates in StatefulSets are not updated automatically after migration 2073496 - Errors in rsync pod creation are not printed in the controller logs 2079814 - [MTC UI] Intra-cluster state migration plan showing a warning on PersistentVolumes page 5. Description: Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications. Bugs fixed (https://bugzilla.redhat.com/): 2062751 - CVE-2022-24730 argocd: path traversal and improper access control allows leaking out-of-bound files 2062755 - CVE-2022-24731 argocd: path traversal allows leaking out-of-bound files 2064682 - CVE-2022-1025 Openshift-Gitops: Improper access control allows admin privilege escalation 5. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. (BZ#2048407) * Rebase package(s) to version: libvirt-7.6.0-6.1.module+el8.5.0+14474+b3410d40 Highlights and important bug fixes: consume libvirt fix for failure to connect socket to '/run/libvirt/virtlogd-sock' - possibly caused by too many open files from libvirtd. (BZ#2057048) 4. 6 ELS) - i386, s390x, x86_64 3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: expat security update Advisory ID: RHSA-2022:1069-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:1069 Issue date: 2022-03-28 CVE Names: CVE-2021-45960 CVE-2021-46143 CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827 CVE-2022-23852 CVE-2022-25235 CVE-2022-25236 CVE-2022-25315 ==================================================================== 1. Summary: An update for expat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: Expat is a C library for parsing XML documents. Security Fix(es): * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235) * expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236) * expat: Integer overflow in storeRawNames() (CVE-2022-25315) * expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960) * expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143) * expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822) * expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823) * expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824) * expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825) * expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826) * expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827) * expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, applications using the Expat library must be restarted for the update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2044451 - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat 2044455 - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c 2044457 - CVE-2022-22822 expat: Integer overflow in addBinding in xmlparse.c 2044464 - CVE-2022-22823 expat: Integer overflow in build_model in xmlparse.c 2044467 - CVE-2022-22824 expat: Integer overflow in defineAttribute in xmlparse.c 2044479 - CVE-2022-22825 expat: Integer overflow in lookup in xmlparse.c 2044484 - CVE-2022-22826 expat: Integer overflow in nextScaffoldPart in xmlparse.c 2044488 - CVE-2022-22827 expat: Integer overflow in storeAtts in xmlparse.c 2044613 - CVE-2022-23852 expat: Integer overflow in function XML_GetBuffer 2056363 - CVE-2022-25315 expat: Integer overflow in storeRawNames() 2056366 - CVE-2022-25235 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution 2056370 - CVE-2022-25236 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: expat-2.1.0-14.el7_9.src.rpm x86_64: expat-2.1.0-14.el7_9.i686.rpm expat-2.1.0-14.el7_9.x86_64.rpm expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm expat-devel-2.1.0-14.el7_9.i686.rpm expat-devel-2.1.0-14.el7_9.x86_64.rpm expat-static-2.1.0-14.el7_9.i686.rpm expat-static-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: expat-2.1.0-14.el7_9.src.rpm x86_64: expat-2.1.0-14.el7_9.i686.rpm expat-2.1.0-14.el7_9.x86_64.rpm expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm expat-devel-2.1.0-14.el7_9.i686.rpm expat-devel-2.1.0-14.el7_9.x86_64.rpm expat-static-2.1.0-14.el7_9.i686.rpm expat-static-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: expat-2.1.0-14.el7_9.src.rpm ppc64: expat-2.1.0-14.el7_9.ppc.rpm expat-2.1.0-14.el7_9.ppc64.rpm expat-debuginfo-2.1.0-14.el7_9.ppc.rpm expat-debuginfo-2.1.0-14.el7_9.ppc64.rpm expat-devel-2.1.0-14.el7_9.ppc.rpm expat-devel-2.1.0-14.el7_9.ppc64.rpm ppc64le: expat-2.1.0-14.el7_9.ppc64le.rpm expat-debuginfo-2.1.0-14.el7_9.ppc64le.rpm expat-devel-2.1.0-14.el7_9.ppc64le.rpm s390x: expat-2.1.0-14.el7_9.s390.rpm expat-2.1.0-14.el7_9.s390x.rpm expat-debuginfo-2.1.0-14.el7_9.s390.rpm expat-debuginfo-2.1.0-14.el7_9.s390x.rpm expat-devel-2.1.0-14.el7_9.s390.rpm expat-devel-2.1.0-14.el7_9.s390x.rpm x86_64: expat-2.1.0-14.el7_9.i686.rpm expat-2.1.0-14.el7_9.x86_64.rpm expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm expat-devel-2.1.0-14.el7_9.i686.rpm expat-devel-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: expat-debuginfo-2.1.0-14.el7_9.ppc.rpm expat-debuginfo-2.1.0-14.el7_9.ppc64.rpm expat-static-2.1.0-14.el7_9.ppc.rpm expat-static-2.1.0-14.el7_9.ppc64.rpm ppc64le: expat-debuginfo-2.1.0-14.el7_9.ppc64le.rpm expat-static-2.1.0-14.el7_9.ppc64le.rpm s390x: expat-debuginfo-2.1.0-14.el7_9.s390.rpm expat-debuginfo-2.1.0-14.el7_9.s390x.rpm expat-static-2.1.0-14.el7_9.s390.rpm expat-static-2.1.0-14.el7_9.s390x.rpm x86_64: expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm expat-static-2.1.0-14.el7_9.i686.rpm expat-static-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: expat-2.1.0-14.el7_9.src.rpm x86_64: expat-2.1.0-14.el7_9.i686.rpm expat-2.1.0-14.el7_9.x86_64.rpm expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm expat-devel-2.1.0-14.el7_9.i686.rpm expat-devel-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm expat-static-2.1.0-14.el7_9.i686.rpm expat-static-2.1.0-14.el7_9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-45960 https://access.redhat.com/security/cve/CVE-2021-46143 https://access.redhat.com/security/cve/CVE-2022-22822 https://access.redhat.com/security/cve/CVE-2022-22823 https://access.redhat.com/security/cve/CVE-2022-22824 https://access.redhat.com/security/cve/CVE-2022-22825 https://access.redhat.com/security/cve/CVE-2022-22826 https://access.redhat.com/security/cve/CVE-2022-22827 https://access.redhat.com/security/cve/CVE-2022-23852 https://access.redhat.com/security/cve/CVE-2022-25235 https://access.redhat.com/security/cve/CVE-2022-25236 https://access.redhat.com/security/cve/CVE-2022-25315 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYkHUz9zjgjWX9erEAQjleA//dK8XzyiK0FY595G0f3CKvLMTMTPEEqf7 3nIHiGzC/lD2o6Y/4ed1iRpndjGVndXyu03AnOFob9P3zqQKBOKiWYcnFNuANAyh WAVTDyjglJ5PvLQe31QHDT1N5KlzN/hskhhyIBgZ+mWq90amXHIX1Xgsy6x72lLD jJF5usHqz4EbIoOn8m0jjDibJFjOOFh2a3qxFnVuMA5+PrcsfnpdVa32I8EMH/sW TODqkz3XLSaaJNWzePOPwZshkriapmU9DqkWdiEVOgJDx0MAn3S5q5MUkHJWRM29 3ZFqQncDQYYYXp8J3AcdX2VXCok0vfIQLWWIvsoGvcpl94lhYsztBGZJttjiVNkV kPX6Wv/W2mMklW7tf0OQOo2Xyh0ZOwB5kfJq7+7SMXzh67M2ifT1Gq7RTAMUProX 3QDm9vVxI7oEBh7HcNychxTaeTwpA2HnGMkUxh0ZX4NkwaOMn0UEBCbxQNXBlPUe 0Qe6srsMV5GSBPk9LoCxpLy+cMc5mya7x1kNS/NZ1CKtqczj4/Oef21I2wqmG/xU 7s9H4o/29X9KhQrOL/sAkqRg2s0yz80Wz1opvXcTgkLj8kzOSN9bQF3ravXXCrUd oqM0cN5PPP/iTqkXs/Dc6HX/iRer15vJ3e4aNu7ZN8+l88mM2BBEmUaDt2ZOHPJb Fq9o8PxEr0c=KN+u -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . 8.2) - aarch64, ppc64le, s390x, x86_64 3. Description: XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to a remote server using HTTP, and gets back the response in XML

Trust: 2.43

sources: NVD: CVE-2022-25235 // JVNDB: JVNDB-2022-003475 // VULHUB: VHN-415126 // PACKETSTORM: 166844 // PACKETSTORM: 166976 // PACKETSTORM: 166433 // PACKETSTORM: 166453 // PACKETSTORM: 166703 // PACKETSTORM: 166496 // PACKETSTORM: 166348 // PACKETSTORM: 166845

AFFECTED PRODUCTS

vendor:oraclemodel:http serverscope:eqversion:12.2.1.4.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:11.0

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:35

Trust: 1.0

vendor:oraclemodel:zfs storage appliance kitscope:eqversion:8.8

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:34

Trust: 1.0

vendor:siemensmodel:sinema remote connect serverscope:ltversion:3.1

Trust: 1.0

vendor:libexpatmodel:libexpatscope:ltversion:2.4.5

Trust: 1.0

vendor:oraclemodel:http serverscope:eqversion:12.2.1.3.0

Trust: 1.0

vendor:オラクルmodel:zfs storage appliance kitscope: - version: -

Trust: 0.8

vendor:libexpatmodel:libexpatscope: - version: -

Trust: 0.8

vendor:debianmodel:gnu/linuxscope: - version: -

Trust: 0.8

vendor:fedoramodel:fedorascope: - version: -

Trust: 0.8

vendor:日立model:日立高信頼サーバ rv3000scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:sinema remote connect serverscope: - version: -

Trust: 0.8

vendor:オラクルmodel:oracle http serverscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-003475 // NVD: CVE-2022-25235

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-25235
value: CRITICAL

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2022-25235
value: CRITICAL

Trust: 1.0

NVD: CVE-2022-25235
value: CRITICAL

Trust: 0.8

VULHUB: VHN-415126
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2022-25235
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-415126
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-25235
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2022-25235
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-415126 // JVNDB: JVNDB-2022-003475 // NVD: CVE-2022-25235 // NVD: CVE-2022-25235

PROBLEMTYPE DATA

problemtype:CWE-116

Trust: 1.1

problemtype:Improper encoding or output escaping (CWE-116) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-415126 // JVNDB: JVNDB-2022-003475 // NVD: CVE-2022-25235

THREAT TYPE

remote

Trust: 0.2

sources: PACKETSTORM: 166844 // PACKETSTORM: 166845

TYPE

overflow, code execution

Trust: 0.4

sources: PACKETSTORM: 166453 // PACKETSTORM: 166703 // PACKETSTORM: 166496 // PACKETSTORM: 166348

PATCH

title:hitachi-sec-2023-204url:https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html

Trust: 0.8

sources: JVNDB: JVNDB-2022-003475

EXTERNAL IDS

db:NVDid:CVE-2022-25235

Trust: 3.5

db:SIEMENSid:SSA-484086

Trust: 1.1

db:OPENWALLid:OSS-SECURITY/2022/02/19/1

Trust: 1.1

db:ICS CERTid:ICSA-22-167-17

Trust: 0.8

db:ICS CERTid:ICSA-23-278-01

Trust: 0.8

db:JVNid:JVNVU99030761

Trust: 0.8

db:JVNid:JVNVU97425465

Trust: 0.8

db:JVNDBid:JVNDB-2022-003475

Trust: 0.8

db:PACKETSTORMid:166433

Trust: 0.2

db:PACKETSTORMid:166453

Trust: 0.2

db:PACKETSTORMid:166496

Trust: 0.2

db:PACKETSTORMid:166348

Trust: 0.2

db:PACKETSTORMid:166277

Trust: 0.1

db:PACKETSTORMid:166293

Trust: 0.1

db:PACKETSTORMid:167226

Trust: 0.1

db:PACKETSTORMid:166276

Trust: 0.1

db:PACKETSTORMid:166505

Trust: 0.1

db:PACKETSTORMid:166500

Trust: 0.1

db:PACKETSTORMid:166296

Trust: 0.1

db:PACKETSTORMid:167008

Trust: 0.1

db:PACKETSTORMid:166983

Trust: 0.1

db:PACKETSTORMid:166954

Trust: 0.1

db:PACKETSTORMid:166298

Trust: 0.1

db:PACKETSTORMid:166261

Trust: 0.1

db:PACKETSTORMid:166275

Trust: 0.1

db:PACKETSTORMid:169777

Trust: 0.1

db:PACKETSTORMid:166291

Trust: 0.1

db:PACKETSTORMid:166437

Trust: 0.1

db:PACKETSTORMid:166414

Trust: 0.1

db:PACKETSTORMid:168578

Trust: 0.1

db:PACKETSTORMid:166300

Trust: 0.1

db:PACKETSTORMid:166274

Trust: 0.1

db:CNVDid:CNVD-2022-18356

Trust: 0.1

db:VULHUBid:VHN-415126

Trust: 0.1

db:PACKETSTORMid:166844

Trust: 0.1

db:PACKETSTORMid:166976

Trust: 0.1

db:PACKETSTORMid:166703

Trust: 0.1

db:PACKETSTORMid:166845

Trust: 0.1

sources: VULHUB: VHN-415126 // PACKETSTORM: 166844 // PACKETSTORM: 166976 // PACKETSTORM: 166433 // PACKETSTORM: 166453 // PACKETSTORM: 166703 // PACKETSTORM: 166496 // PACKETSTORM: 166348 // PACKETSTORM: 166845 // JVNDB: JVNDB-2022-003475 // NVD: CVE-2022-25235

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2022-25235

Trust: 1.5

url:https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf

Trust: 1.1

url:https://security.netapp.com/advisory/ntap-20220303-0008/

Trust: 1.1

url:https://www.debian.org/security/2022/dsa-5085

Trust: 1.1

url:https://security.gentoo.org/glsa/202209-24

Trust: 1.1

url:https://github.com/libexpat/libexpat/pull/562

Trust: 1.1

url:https://www.oracle.com/security-alerts/cpuapr2022.html

Trust: 1.1

url:https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html

Trust: 1.1

url:http://www.openwall.com/lists/oss-security/2022/02/19/1

Trust: 1.1

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/y27xo3jmkaomqzvps3b4mjgeahczf5om/

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ufrba3uqviqkxtbuqxdwqovwnbkleru/

Trust: 1.0

url:https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.8

url:https://access.redhat.com/security/team/contact/

Trust: 0.8

url:https://access.redhat.com/security/cve/cve-2022-25235

Trust: 0.8

url:https://bugzilla.redhat.com/):

Trust: 0.8

url:https://jvn.jp/vu/jvnvu99030761/index.html

Trust: 0.8

url:https://jvn.jp/vu/jvnvu97425465/index.html

Trust: 0.8

url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-17

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-278-01

Trust: 0.8

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.7

url:https://access.redhat.com/security/team/key/

Trust: 0.6

url:https://access.redhat.com/articles/11258

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2022-25236

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2022-25315

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2022-25236

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-22825

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-22825

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-22827

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-22823

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2021-46143

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22826

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-46143

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22827

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-22824

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22823

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-45960

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22824

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-22826

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-22822

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-23852

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22822

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2021-45960

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-25315

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-23852

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-0361

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-31566

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0392

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-23177

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-23218

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-23177

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0318

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0261

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-23308

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0359

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0413

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3999

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-23218

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0359

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-3999

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0413

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0361

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0261

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0392

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-23219

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-31566

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0318

Trust: 0.2

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ufrba3uqviqkxtbuqxdwqovwnbkleru/

Trust: 0.1

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/y27xo3jmkaomqzvps3b4mjgeahczf5om/

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1539

Trust: 0.1

url:https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-41190

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-1154

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-44717

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-41190

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-44717

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-44716

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-1154

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-44716

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-41772

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-25636

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-1271

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-4028

Trust: 0.1

url:https://docs.openshift.com/container-platform/4.10/migration_toolkit_for_containers/mtc-release-notes.html

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1734

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0778

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-4028

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-41772

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-41771

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-41771

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0778

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-1271

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-1025

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1041

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-23219

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-24407

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-24407

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-24731

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-24730

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-23308

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-24731

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-24730

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-1025

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1053

Trust: 0.1

url:https://access.redhat.com/articles/2974891

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1309

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1069

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0951

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1540

Trust: 0.1

sources: VULHUB: VHN-415126 // PACKETSTORM: 166844 // PACKETSTORM: 166976 // PACKETSTORM: 166433 // PACKETSTORM: 166453 // PACKETSTORM: 166703 // PACKETSTORM: 166496 // PACKETSTORM: 166348 // PACKETSTORM: 166845 // JVNDB: JVNDB-2022-003475 // NVD: CVE-2022-25235

CREDITS

Red Hat

Trust: 0.8

sources: PACKETSTORM: 166844 // PACKETSTORM: 166976 // PACKETSTORM: 166433 // PACKETSTORM: 166453 // PACKETSTORM: 166703 // PACKETSTORM: 166496 // PACKETSTORM: 166348 // PACKETSTORM: 166845

SOURCES

db:VULHUBid:VHN-415126
db:PACKETSTORMid:166844
db:PACKETSTORMid:166976
db:PACKETSTORMid:166433
db:PACKETSTORMid:166453
db:PACKETSTORMid:166703
db:PACKETSTORMid:166496
db:PACKETSTORMid:166348
db:PACKETSTORMid:166845
db:JVNDBid:JVNDB-2022-003475
db:NVDid:CVE-2022-25235

LAST UPDATE DATE

2026-04-18T20:27:29.365000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-415126date:2022-10-07T00:00:00
db:JVNDBid:JVNDB-2022-003475date:2023-10-10T06:16:00
db:NVDid:CVE-2022-25235date:2025-05-05T17:18:00.623

SOURCES RELEASE DATE

db:VULHUBid:VHN-415126date:2022-02-16T00:00:00
db:PACKETSTORMid:166844date:2022-04-27T17:30:03
db:PACKETSTORMid:166976date:2022-05-05T17:35:22
db:PACKETSTORMid:166433date:2022-03-24T14:36:50
db:PACKETSTORMid:166453date:2022-03-25T15:19:32
db:PACKETSTORMid:166703date:2022-04-12T18:00:30
db:PACKETSTORMid:166496date:2022-03-28T15:54:26
db:PACKETSTORMid:166348date:2022-03-17T15:51:32
db:PACKETSTORMid:166845date:2022-04-27T17:30:31
db:JVNDBid:JVNDB-2022-003475date:2023-02-21T00:00:00
db:NVDid:CVE-2022-25235date:2022-02-16T01:15:07.607