ID

VAR-202203-1690

CVE

CVE-2018-25032

TITLE

Red Hat Security Advisory 2022-5924-01

DESCRIPTION

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. Summary: An update is now available for Service Telemetry Framework 1.4 for RHEL 8. Description: Service Telemetry Framework (STF) provides automated collection of measurements and data from remote clients, such as Red Hat OpenStack Platform or third-party nodes. Bugs fixed (https://bugzilla.redhat.com/): 2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read 5. Bugs fixed (https://bugzilla.redhat.com/): 2016290 - [Warm] Warm Migration Fails and reporting ambiguous status. 2033346 - [cnv-4.10] Add vm name label to virt-launcher pods 2037605 - Openshift Virtualization alert 50% of the hyperconverged-cluster-operator-metrics/hyperconverged-cluster-operator-metrics targets in openshift-cnv namespace have been unreachable for more than 15 minutes on port 8686 2045880 - CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter 2074384 - SAP HANA template - template should be moved to https://github.com/RHsyseng/cnv-supplemental-templates 2080453 - [4.10.z] cluster-network-addons-operator deployment's MULTUS_IMAGE is pointing to brew image 2080918 - Upgrade CNV from 4.10.1 to 4.11 should be blocked if CNV k8s-nmstate is still installed 2083594 - virtctl guestfs incorrectly assumes image name 2085459 - smartclone-controller not started and cloned DataVolumes stuck in SnapshotForSmartCloneInProgress 2086114 - HCO is taking more than 12 minutes to reconcile consolequickstart connect-ext-net-to-vm and customize-a-boot-source 2086541 - NMO CSV dependency to CNV is failing 2088476 - [4.10.z] VMSnapshot restore fails to provision volume with size mismatch error 2088622 - 4.10.2 containers 2089637 - CNAO is blocking upgrade to 4.11 despite standalone nmstate operator is installed 2089658 - SSP Reconcile logging improvement when CR resources are changed 2089661 - [CNV-4.10] HCO Being Unable to Reconcile State 5. Security Fix(es): * argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 4. Bugs fixed (https://bugzilla.redhat.com/): 2096278 - CVE-2022-31035 argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI 2096282 - CVE-2022-31034 argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI. 2096283 - CVE-2022-31016 argocd: vulnerable to an uncontrolled memory consumption bug 2096291 - CVE-2022-31036 argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access 5. Description: Release of RHACS 3.69.2 Security Fix(es): * stackrox: Improper sanitization allows users to retrieve Notifier secrets from GraphQL API in plaintext (CVE-2022-1902) 3. Solution: If you are using the RHACS 3.69.1, you are advised to upgrade to patch release 3.69.2. Bugs fixed (https://bugzilla.redhat.com/): 2090957 - CVE-2022-1902 stackrox: Improper sanitization allows users to retrieve Notifier secrets from GraphQL API in plaintext 5. JIRA issues fixed (https://issues.jboss.org/): ROX-11455 - Release RHACS 3.69.1 ROX-9657 - Patch supported RHACS images previous to 3.69.0 release to fix RHSA-2022:0658 6. Bugs fixed (https://bugzilla.redhat.com/): 2080850 - CVE-2022-25647 com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson 2088748 - CVE-2022-28948 golang-gopkg-yaml: crash when attempting to deserialize invalid input 5. Bugs fixed (https://bugzilla.redhat.com/): 2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data 2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way 2031958 - CVE-2021-43797 netty: control chars in header names may lead to HTTP request smuggling 2045880 - CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter 5. JIRA issues fixed (https://issues.jboss.org/): LOG-2437 - EO shouldn't grant cluster-wide permission to system:serviceaccount:openshift-monitoring:prometheus-k8s when ES cluster is deployed. [openshift-logging 5.4] LOG-2442 - Log file metric exporter not working with /var/log/pods LOG-2448 - Audit and journald logs cannot be viewed from LokiStack, when logs are forwarded with Vector as collector. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2022:2280 Space precludes documenting all of the container images in this advisory. Solution: For OpenShift Container Platform 3.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/3.11/upgrading/index.html 4. Bugs fixed (https://bugzilla.redhat.com/): 2076211 - CVE-2022-1677 openshift/router: route hijacking attack via crafted HAProxy configuration file 2086938 - Placeholder bug for OCP 3.11.z image release 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: security update for rh-sso-7/sso75-openshift-rhel8 container image Advisory ID: RHSA-2022:1713-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2022:1713 Issue date: 2022-05-04 CVE Names: CVE-2018-25032 CVE-2022-1154 CVE-2022-1245 CVE-2022-1271 CVE-2022-21426 CVE-2022-21434 CVE-2022-21443 CVE-2022-21476 CVE-2022-21496 ==================================================================== 1. Summary: Security updated rh-sso-7/sso75-openshift-rhel8 container image is now available for RHEL-8 based Middleware Containers. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: The rh-sso-7/sso75-openshift-rhel8 container image has been updated for RHEL-8 based Middleware Containers to include the following security issues. Security Fix(es): * keycloak: Privilege escalation vulnerability on Token Exchange (CVE-2022-1245) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Users of rh-sso-7/sso75-openshift-rhel8 container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images. You can find images updated by this advisory in Red Hat Container Catalog (see References). 3. Solution: The RHEL-8 based Middleware Containers container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References). Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally. 4. Bugs fixed (https://bugzilla.redhat.com/): 2071036 - CVE-2022-1245 keycloak: Privilege escalation vulnerability on Token Exchange 5. References: https://access.redhat.com/security/cve/CVE-2018-25032 https://access.redhat.com/security/cve/CVE-2022-1154 https://access.redhat.com/security/cve/CVE-2022-1245 https://access.redhat.com/security/cve/CVE-2022-1271 https://access.redhat.com/security/cve/CVE-2022-21426 https://access.redhat.com/security/cve/CVE-2022-21434 https://access.redhat.com/security/cve/CVE-2022-21443 https://access.redhat.com/security/cve/CVE-2022-21476 https://access.redhat.com/security/cve/CVE-2022-21496 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/security/cve/cve-2022-1245 https://access.redhat.com/containers/?tab=images#/registry.access.redhat.com/rh-sso-7/sso75-openshift-rhel8 https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/html/release_notes/index 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYnL7XdzjgjWX9erEAQjfJA/5Ad18mlBZpbopQ52tgIVratvkE92jHUbN 8CFkLR1PO53voCMLen5U1SEtuy40WQXR1ttzuiVNNi+GYKCPX2SKij86OXWbgaYS JRVmpSmPCwRwmxi+JyrWZU2+zYfRPqCMgH7XOwpVZaKbyuu+p6sFRb508ECMdFq7 FBDuK1RlfT3Hh/LdLit8xP7O80SU8iy6SfAVn74B10AL8WEnVDg+pnPJ2qSmeLH9 2zDzq2Vcpd0EZTb3MdGSUtPShwJ/MW/Uw84FToa+OWnfZz2VGMhaOEo4zZSLrevH bQJRccF7kHiHiBeqYqwiohEwFv3W94M5Cn2xJZXB6/rFejrD8Fz1hBEbxrwF/Knc lw8EIZTPoQo3TDwQnLYwMHz/c6a3sTPV9dHuXqmvaDDx0TDxI1SIAdY0E/AyP2zF hSYks5MREEAjxwqHlUnUqYfTbz9HkXjlLijEktm3gzwCBb/ZdOWmb165PzzcZYSA ra2/kr2oXDSkQ3vc+witL2WvR6GgflrL1ogPBSEVAXqk+4hH4JZNm1u9YKXAwgm3 1knWLkVsFnKw/kifSkGMZE/X5v8K2uK8KjwQvart8J/Kh2AgVuM1IuJAq+kBZuhf TAeBBSvotkGQuzG76aFtfRKeiI1KP5g8P0aVd5ST4SVGncY495RY5WsdTnHxbowV FnYVhu8AIpk=psbs -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

xss

EXPLOIT AVAILABILITY

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2026-04-18T22:02:12.514000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE