csaf_redhat - rhsa-2022:6430

rhsa-2022:6430

Vulnerability from csaf_redhat

Published

2022-09-13 02:09

Modified

2025-08-13 09:32

Summary

Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.0.4 security and bug fix update

Notes

Topic

OpenShift API for Data Protection (OADP) 1.0.4 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

OpenShift API for Data Protection (OADP) enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and snapshot-based backups for persistent volumes. Security Fix(es): * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962) * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698) * golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675) * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148) * golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "OpenShift API for Data Protection (OADP) 1.0.4 is now available.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift API for Data Protection (OADP) enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and snapshot-based backups for persistent volumes.\n\nSecurity Fix(es):\n\n* golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)\n\n* golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)\n\n* prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)\n\n* golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675)\n\n* golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)\n\n* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)\n\n* golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)\n\n* golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:6430",
        "url": "https://access.redhat.com/errata/RHSA-2022:6430"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2045880",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2045880"
      },
      {
        "category": "external",
        "summary": "2077688",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2077688"
      },
      {
        "category": "external",
        "summary": "2092793",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2092793"
      },
      {
        "category": "external",
        "summary": "2107342",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107342"
      },
      {
        "category": "external",
        "summary": "2107371",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107371"
      },
      {
        "category": "external",
        "summary": "2107374",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107374"
      },
      {
        "category": "external",
        "summary": "2107376",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107376"
      },
      {
        "category": "external",
        "summary": "2107383",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107383"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6430.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.0.4 security and bug fix update",
    "tracking": {
      "current_release_date": "2025-08-13T09:32:59+00:00",
      "generator": {
        "date": "2025-08-13T09:32:59+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.6"
        }
      },
      "id": "RHSA-2022:6430",
      "initial_release_date": "2022-09-13T02:09:43+00:00",
      "revision_history": [
        {
          "date": "2022-09-13T02:09:43+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-09-13T02:09:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-08-13T09:32:59+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "8Base-OADP-1.0",
                "product": {
                  "name": "8Base-OADP-1.0",
                  "product_id": "8Base-OADP-1.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_api_data_protection:1.0::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenShift API for Data Protection"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
                "product": {
                  "name": "oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
                  "product_id": "oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel8\u0026tag=1.0.4-11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
                "product": {
                  "name": "oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
                  "product_id": "oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel8\u0026tag=1.0.4-17"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
                "product": {
                  "name": "oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
                  "product_id": "oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-operator-bundle\u0026tag=1.0.4-17"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
                "product": {
                  "name": "oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
                  "product_id": "oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-rhel8-operator\u0026tag=1.0.4-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
                "product": {
                  "name": "oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
                  "product_id": "oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-registry-rhel8\u0026tag=1.0.4-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64",
                "product": {
                  "name": "oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64",
                  "product_id": "oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel8\u0026tag=1.0.4-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
                "product": {
                  "name": "oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
                  "product_id": "oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel8\u0026tag=1.0.4-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
                "product": {
                  "name": "oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
                  "product_id": "oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel8\u0026tag=1.0.4-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
                "product": {
                  "name": "oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
                  "product_id": "oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel8\u0026tag=1.0.4-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
                "product": {
                  "name": "oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
                  "product_id": "oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel8\u0026tag=1.0.4-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
                "product": {
                  "name": "oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
                  "product_id": "oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel8\u0026tag=1.0.4-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
                "product": {
                  "name": "oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
                  "product_id": "oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel8\u0026tag=1.0.4-6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64"
        },
        "product_reference": "oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64"
        },
        "product_reference": "oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64"
        },
        "product_reference": "oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64"
        },
        "product_reference": "oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64"
        },
        "product_reference": "oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64"
        },
        "product_reference": "oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64"
        },
        "product_reference": "oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64"
        },
        "product_reference": "oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64"
        },
        "product_reference": "oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64"
        },
        "product_reference": "oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64"
        },
        "product_reference": "oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64 as a component of 8Base-OADP-1.0",
          "product_id": "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
        },
        "product_reference": "oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64",
        "relates_to_product_reference": "8Base-OADP-1.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-1705",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107374"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating \"chunked\" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http: improper sanitization of Transfer-Encoding header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe platform uses secure, encrypted HTTPS connections over TLS 1.2 to reduce the risk of smuggling attacks by preventing the injection of ambiguous or malformed requests between components. The environment employs IPS/IDS and antimalware solutions to detect and block malicious code while ensuring consistent interpretation of HTTP requests across network layers, mitigating request/response inconsistencies. Event logs are collected and analyzed for centralization, correlation, monitoring, alerting, and retention, enabling the detection of malformed or suspicious HTTP traffic. Static code analysis and peer reviews enforce strong input validation and error handling to ensure all user inputs adhere to HTTP protocol specifications.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
        ],
        "known_not_affected": [
          "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
          "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
          "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
          "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
          "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-1705"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107374",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107374"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1705",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-1705"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1705",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1705"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53188",
          "url": "https://go.dev/issue/53188"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-13T02:09:43+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6430"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: net/http: improper sanitization of Transfer-Encoding header"
    },
    {
      "cve": "CVE-2022-1962",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107376"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go source code, which contains deeply nested types or declarations, a panic can occur due to stack exhaustion. This issue allows an attacker to impact system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: go/parser: stack exhaustion in all Parse* functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
        ],
        "known_not_affected": [
          "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
          "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
          "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
          "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
          "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-1962"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107376",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107376"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1962",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-1962"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1962",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1962"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53616",
          "url": "https://go.dev/issue/53616"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-13T02:09:43+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6430"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: go/parser: stack exhaustion in all Parse* functions"
    },
    {
      "cve": "CVE-2022-21698",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2022-01-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2045880"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service attack was found in prometheus/client_golang. This flaw allows an attacker to produce a denial of service attack on an HTTP server by exploiting the InstrumentHandlerCounter function in the version below 1.11.1, resulting in a loss of availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "prometheus/client_golang: Denial of service using InstrumentHandlerCounter",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has been rated as having a moderate impact for two main reasons. The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. Additionally, this is in alignment with upstream\u0027s (the Prometheus project) impact rating.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64"
        ],
        "known_not_affected": [
          "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
          "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
          "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
          "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-21698"
        },
        {
          "category": "external",
          "summary": "RHBZ#2045880",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2045880"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21698",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-21698"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21698",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21698"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p",
          "url": "https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p"
        }
      ],
      "release_date": "2022-02-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-13T02:09:43+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6430"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "prometheus/client_golang: Denial of service using InstrumentHandlerCounter"
    },
    {
      "cve": "CVE-2022-24675",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2022-04-21T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2077688"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow flaw was found in Golang\u0027s library encoding/pem. This flaw allows an attacker to use a large PEM input (more than 5 MB), causing a stack overflow in Decode, which leads to a loss of availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: encoding/pem: fix stack overflow in Decode",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 7, 8 and 9 are affected, because the code-base is affected by this vulnerability.\n\nRed Hat Product Security has rated this issue as having Moderate security impact, and the issue is not currently planned to be addressed in future updates for Red Hat Enterprise Linux 7, hence, marked as Out-of-Support-Scope.\n\nRed Hat Developer Tools - Compilers (go-toolset-1.16-golang \u0026 go-toolset-1.17-golang), ships the vulnerable code and affected by this vulnerability.\n\nFor additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle \u0026 Updates Policy: https://access.redhat.com/support/policy/updates/errata/.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nRed Hat follows best practice and federal requirements for least privilege, allowing only specific processes to be run with isolated accounts specific to the team and federal platforms that have limited privileges that are only used for a single task. The environment leverages file integrity checks and malicious code protections, such as IPS/IDS and antimalware solutions, to help detect and prevent malicious code that attempts to exploit buffer overflow vulnerabilities. Robust input validation and error-handling mechanisms ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64"
        ],
        "known_not_affected": [
          "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
          "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
          "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
          "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-24675"
        },
        {
          "category": "external",
          "summary": "RHBZ#2077688",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2077688"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24675",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-24675"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24675",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24675"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/oecdBNLOml8",
          "url": "https://groups.google.com/g/golang-announce/c/oecdBNLOml8"
        }
      ],
      "release_date": "2022-04-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-13T02:09:43+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6430"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: encoding/pem: fix stack overflow in Decode"
    },
    {
      "cve": "CVE-2022-30629",
      "cwe": {
        "id": "CWE-331",
        "name": "Insufficient Entropy"
      },
      "discovery_date": "2022-06-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2092793"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the crypto/tls golang package. When session tickets are generated by crypto/tls, it is missing the ticket expiration. This issue may allow an attacker to observe the TLS handshakes to correlate successive connections during session resumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: crypto/tls: session tickets lack random ticket_age_add",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
          "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
          "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
          "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
          "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30629"
        },
        {
          "category": "external",
          "summary": "RHBZ#2092793",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2092793"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30629",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30629"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30629",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30629"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg",
          "url": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg"
        }
      ],
      "release_date": "2022-06-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-13T02:09:43+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6430"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "golang: crypto/tls: session tickets lack random ticket_age_add"
    },
    {
      "cve": "CVE-2022-30630",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107371"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: io/fs: stack exhaustion in Glob",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "RH ProdSec has set the Impact of this vulnerability to Moderate as there is no known method to execute arbitary code. Successful exploitation of this bug can cause the application under attack to panic, merely causing a Denial of Service at the application level. As the kernel is unaffected by this bug, the user can merely relaunch the application to fix the problem. Also, if somehow the application keeps relaunching, the timer watchdogs in the default RHEL kernel will stop the attack in its tracks.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-1325: Improperly Controlled Sequential Memory Allocation vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nAccess to the platform is granted only after successful hard token-based multi-factor authentication (MFA) and is governed by least privilege to ensure only authorized users and roles can execute or modify code. Static code analysis and peer reviews enforce strong input validation and error handling, preventing improperly validated inputs from causing system instability, data exposure, or privilege escalation. In the event of successful exploitation, process isolation limits the impact of excessive sequential memory allocation by restricting memory use per process, preventing any single process from exhausting system resources. Finally, the platform uses memory protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) to reduce the risk of memory allocation-based attacks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
        ],
        "known_not_affected": [
          "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
          "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
          "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
          "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
          "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30630"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107371",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107371"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30630",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30630"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30630",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30630"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53415",
          "url": "https://go.dev/issue/53415"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-13T02:09:43+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6430"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: io/fs: stack exhaustion in Glob"
    },
    {
      "cve": "CVE-2022-30631",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107342"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: compress/gzip: stack exhaustion in Reader.Read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit CVE-2022-30631, an attacker supplies a specially crafted gzip archive to a Go application that uses a vulnerable version of the compress/gzip package without adequate input validation. This can lead to uncontrolled recursion, resulting in stack exhaustion and causing the application to panic, thereby affecting its availability.\n\nAs this is merely a DoS and there is no known way to control the instruction pointer, RH ProdSec has set the impact of this vulnerabilty to \"Moderate\".\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-1325: Improperly Controlled Sequential Memory Allocation vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nAccess to the platform is granted only after successful hard token-based multi-factor authentication (MFA) and is governed by least privilege to ensure only authorized users and roles can execute or modify code. Static code analysis and peer reviews enforce strong input validation and error handling, preventing improperly validated inputs from causing system instability, data exposure, or privilege escalation. In the event of successful exploitation, process isolation limits the impact of excessive sequential memory allocation by restricting memory use per process, preventing any single process from exhausting system resources. Finally, the platform uses memory protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) to reduce the risk of memory allocation-based attacks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
        ],
        "known_not_affected": [
          "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
          "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
          "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
          "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
          "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30631"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107342",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107342"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30631",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30631"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30631",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30631"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53168",
          "url": "https://go.dev/issue/53168"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-13T02:09:43+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6430"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: compress/gzip: stack exhaustion in Reader.Read"
    },
    {
      "cve": "CVE-2022-32148",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2022-07-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2107383"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in net/http/httputil golang package. When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy could set the client IP incorrectly. This issue may affect confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nAccess to the platform is granted only after successful hard token, multi-factor authentication (MFA), which is coupled with account management controls, including integration with single sign-on (SSO), to ensure that user permissions are restricted to only the functions necessary for their roles. Access to sensitive information is explicitly authorized and enforced based on predefined access policies. Event logs are collected and processed for centralization, correlation, analysis, monitoring, reporting, alerting, and retention. This process ensures that audit logs are generated for specific events involving sensitive information, which helps identify patterns of unauthorized access or data exposure. The platform enforces the use of validated cryptographic modules across compute resources to protect the confidentiality of information, even in the event of interception.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
        ],
        "known_not_affected": [
          "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
          "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
          "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
          "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
          "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
          "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-32148"
        },
        {
          "category": "external",
          "summary": "RHBZ#2107383",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107383"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-32148",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-32148"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-32148",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32148"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53423",
          "url": "https://go.dev/issue/53423"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE",
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        }
      ],
      "release_date": "2022-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-09-13T02:09:43+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:6430"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-OADP-1.0:oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:d5d5e8252fd5c5fc38e0a28aef3b209302da2403381906a4fc16996201ea602d_amd64",
            "8Base-OADP-1.0:oadp/oadp-mustgather-rhel8@sha256:ce71a41a5ea7455baf6ef8b71e3212f61fba35ade50b632b91cdf53ae2cd412f_amd64",
            "8Base-OADP-1.0:oadp/oadp-operator-bundle@sha256:d803961b4c075fe513459313dea1245871413d29d3232a0a12973db7398409db_amd64",
            "8Base-OADP-1.0:oadp/oadp-registry-rhel8@sha256:10ab07c1494e47c1da64e61e5a5e5889e5e74429a10da95a9f908f5bf0c0553a_amd64",
            "8Base-OADP-1.0:oadp/oadp-rhel8-operator@sha256:8769890ce3bd07afb147fd045bdfd4dd02f7d2a83857728d60fe576c455f8a56_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-aws-rhel8@sha256:d8672ec946550fb12ba952f305bc9cb4d820b776a5b16b7932657837b4d242ab_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-csi-rhel8@sha256:58b31dd30b9bcb47a5d590ca4197ea4aebd6ba5e9e73055a5889da889d1e63e8_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:dfcf22434189301007fb440c6b714a04163c931cbc3021f337b19ccf840bde70_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:383434ed3aafd0b55384f84fd1204b8ae62e6743472ca9f1beb0878be8044f89_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-plugin-rhel8@sha256:bf5d6974202df79eac08dfd475fa1c2f7d21819ef5e4d5a7f761b73424429128_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-restic-restore-helper-rhel8@sha256:31dfff0d43517d4dee4c47a1d05705b30b74a180794cc6f8a2a156b91c14d5fd_amd64",
            "8Base-OADP-1.0:oadp/oadp-velero-rhel8@sha256:efb4eb48cbd2ee2276844bc6a6c0fb402c293faabd0a56b1ba3e8b41da0d99a8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working"
    }
  ]
}

CVE-2022-30631 (GCVE-0-2022-30631)

Vulnerability from cvelistv5

Published

2022-08-09 20:16

Modified

2024-08-03 06:56

Severity ?

CWE

CWE-674: Uncontrolled Recursion

Summary

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

References

►

URL

Tags

	https://go.dev/cl/417067
	https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e
	https://go.dev/issue/53168
	https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
	https://pkg.go.dev/vuln/GO-2022-0524

Impacted products

	Vendor	Product	Version
	Go standard library	compress/gzip	Version: 0 ≤ Version: 1.18.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:13.231Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417067"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53168"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0524"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "compress/gzip",
          "product": "compress/gzip",
          "programRoutines": [
            {
              "name": "Reader.Read"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:40.977Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417067"
        },
        {
          "url": "https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e"
        },
        {
          "url": "https://go.dev/issue/53168"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0524"
        }
      ],
      "title": "Stack exhaustion when reading certain archives in compress/gzip"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30631",
    "datePublished": "2022-08-09T20:16:32",
    "dateReserved": "2022-05-12T00:00:00",
    "dateUpdated": "2024-08-03T06:56:13.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1962 (GCVE-0-2022-1962)

Vulnerability from cvelistv5

Published

2022-08-09 20:18

Modified

2024-08-03 00:24

Severity ?

CWE

CWE-674: Uncontrolled Recursion

Summary

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

References

►

URL

Tags

	https://go.dev/cl/417063
	https://go.googlesource.com/go/+/695be961d57508da5a82217f7415200a11845879
	https://go.dev/issue/53616
	https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
	https://pkg.go.dev/vuln/GO-2022-0515

Impacted products

	Vendor	Product	Version
	Go standard library	go/parser	Version: 0 ≤ Version: 1.18.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:43.737Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417063"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/695be961d57508da5a82217f7415200a11845879"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53616"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0515"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "go/parser",
          "product": "go/parser",
          "programRoutines": [
            {
              "name": "ParseFile"
            },
            {
              "name": "ParseExprFrom"
            },
            {
              "name": "parser.tryIdentOrType"
            },
            {
              "name": "parser.parsePrimaryExpr"
            },
            {
              "name": "parser.parseUnaryExpr"
            },
            {
              "name": "parser.parseBinaryExpr"
            },
            {
              "name": "parser.parseIfStmt"
            },
            {
              "name": "parser.parseStmt"
            },
            {
              "name": "resolver.openScope"
            },
            {
              "name": "resolver.closeScope"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Juho Nurminen of Mattermost"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:29.406Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417063"
        },
        {
          "url": "https://go.googlesource.com/go/+/695be961d57508da5a82217f7415200a11845879"
        },
        {
          "url": "https://go.dev/issue/53616"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0515"
        }
      ],
      "title": "Stack exhaustion due to deeply nested types in go/parser"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-1962",
    "datePublished": "2022-08-09T20:18:18",
    "dateReserved": "2022-05-31T00:00:00",
    "dateUpdated": "2024-08-03T00:24:43.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1705 (GCVE-0-2022-1705)

Vulnerability from cvelistv5

Published

2022-08-09 20:16

Modified

2024-08-03 00:10

Severity ?

CWE

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Summary

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

References

►

URL

Tags

	https://go.dev/cl/409874
	https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5f
	https://go.dev/issue/53188
	https://go.dev/cl/410714
	https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
	https://pkg.go.dev/vuln/GO-2022-0525

Impacted products

	Vendor	Product	Version
	Go standard library	net/http	Version: 0 ≤ Version: 1.18.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:10:03.918Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/409874"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53188"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/410714"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0525"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "transferReader.parseTransferEncoding"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Zeyu Zhang (https://www.zeyu2001.com/)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request Smuggling\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:43.089Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/409874"
        },
        {
          "url": "https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5f"
        },
        {
          "url": "https://go.dev/issue/53188"
        },
        {
          "url": "https://go.dev/cl/410714"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0525"
        }
      ],
      "title": "Improper sanitization of Transfer-Encoding headers in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-1705",
    "datePublished": "2022-08-09T20:16:57",
    "dateReserved": "2022-05-13T00:00:00",
    "dateUpdated": "2024-08-03T00:10:03.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-30630 (GCVE-0-2022-30630)

Vulnerability from cvelistv5

Published

2022-08-09 20:17

Modified

2024-08-03 06:56

Severity ?

CWE

CWE-674: Uncontrolled Recursion

Summary

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

References

►

URL

Tags

	https://go.dev/cl/417065
	https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59
	https://go.dev/issue/53415
	https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
	https://pkg.go.dev/vuln/GO-2022-0527

Impacted products

	Vendor	Product	Version
	Go standard library	io/fs	Version: 0 ≤ Version: 1.18.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:12.871Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417065"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53415"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0527"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "io/fs",
          "product": "io/fs",
          "programRoutines": [
            {
              "name": "Glob"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:48.349Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417065"
        },
        {
          "url": "https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59"
        },
        {
          "url": "https://go.dev/issue/53415"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0527"
        }
      ],
      "title": "Stack exhaustion in Glob on certain paths in io/fs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30630",
    "datePublished": "2022-08-09T20:17:15",
    "dateReserved": "2022-05-12T00:00:00",
    "dateUpdated": "2024-08-03T06:56:12.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24675 (GCVE-0-2022-24675)

Vulnerability from cvelistv5

Published

2022-04-20 00:00

Modified

2024-08-03 04:20

Severity ?

CWE

Summary

encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

References

►

URL

Tags

	https://groups.google.com/g/golang-announce
	https://groups.google.com/g/golang-announce/c/oecdBNLOml8
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TYZC4OAY54TO75FBEFAPV5G7O4D5TM/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3BMW5QGX53CMIJIZWKXFKBJX2C5GWTY/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCRSABD6CUDIZULZPZL5BJ3ET3A2NEJP/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/	vendor-advisory
	https://security.gentoo.org/glsa/202208-02	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20220915-0010/
	https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:49.135Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/oecdBNLOml8"
          },
          {
            "name": "FEDORA-2022-a49babed75",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TYZC4OAY54TO75FBEFAPV5G7O4D5TM/"
          },
          {
            "name": "FEDORA-2022-c0f780ecf1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3BMW5QGX53CMIJIZWKXFKBJX2C5GWTY/"
          },
          {
            "name": "FEDORA-2022-e46e6e8317",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCRSABD6CUDIZULZPZL5BJ3ET3A2NEJP/"
          },
          {
            "name": "FEDORA-2022-fae3ecee19",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/"
          },
          {
            "name": "FEDORA-2022-ba365d3703",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/"
          },
          {
            "name": "GLSA-202208-02",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202208-02"
          },
          {
            "name": "FEDORA-2022-30c5ed5625",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220915-0010/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-14T00:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://groups.google.com/g/golang-announce"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/oecdBNLOml8"
        },
        {
          "name": "FEDORA-2022-a49babed75",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TYZC4OAY54TO75FBEFAPV5G7O4D5TM/"
        },
        {
          "name": "FEDORA-2022-c0f780ecf1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3BMW5QGX53CMIJIZWKXFKBJX2C5GWTY/"
        },
        {
          "name": "FEDORA-2022-e46e6e8317",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCRSABD6CUDIZULZPZL5BJ3ET3A2NEJP/"
        },
        {
          "name": "FEDORA-2022-fae3ecee19",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/"
        },
        {
          "name": "FEDORA-2022-ba365d3703",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/"
        },
        {
          "name": "GLSA-202208-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202208-02"
        },
        {
          "name": "FEDORA-2022-30c5ed5625",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20220915-0010/"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-24675",
    "datePublished": "2022-04-20T00:00:00",
    "dateReserved": "2022-02-08T00:00:00",
    "dateUpdated": "2024-08-03T04:20:49.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-32148 (GCVE-0-2022-32148)

Vulnerability from cvelistv5

Published

2022-08-09 20:18

Modified

2024-08-03 07:32

Severity ?

CWE

CWE-200: Information Exposure

Summary

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.

References

►

URL

Tags

	https://go.dev/cl/412857
	https://go.googlesource.com/go/+/b2cc0fecc2ccd80e6d5d16542cc684f97b3a9c8a
	https://go.dev/issue/53423
	https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
	https://pkg.go.dev/vuln/GO-2022-0520

Impacted products

	Vendor	Product	Version
	Go standard library	net/http	Version: 0 ≤ Version: 1.18.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:32:55.971Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/412857"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/b2cc0fecc2ccd80e6d5d16542cc684f97b3a9c8a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53423"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0520"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "Header.Clone"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Christian Mehlmauer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200: Information Exposure",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:32.608Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/412857"
        },
        {
          "url": "https://go.googlesource.com/go/+/b2cc0fecc2ccd80e6d5d16542cc684f97b3a9c8a"
        },
        {
          "url": "https://go.dev/issue/53423"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0520"
        }
      ],
      "title": "Exposure of client IP addresses in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-32148",
    "datePublished": "2022-08-09T20:18:21",
    "dateReserved": "2022-05-31T00:00:00",
    "dateUpdated": "2024-08-03T07:32:55.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21698 (GCVE-0-2022-21698)

Vulnerability from cvelistv5

Published

2022-02-15 00:00

Modified

2025-04-23 19:05

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400 - Uncontrolled Resource Consumption

Summary

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

References

►

URL

Tags

	https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p
	https://github.com/prometheus/client_golang/pull/962
	https://github.com/prometheus/client_golang/pull/987
	https://github.com/prometheus/client_golang/releases/tag/v1.11.1
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FY3N7H6VSDZM37B4SKM2PFFCUWU7QYWN/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKORFJTRRDJCWBTJPISKKCVMMMJBIRLG/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AK7CJBCGERCRXYUR2EWDSSDVAQMTAZGX/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SASRKYHT5ZFSVMJUQUG3UAEQRJYGJKAR/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBMVIQFKQDSSTHVVJWJ4QH6TW3JVB7XZ/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V7I72LSQ3IET3QJR6QPAVGJZ4CBDLN5/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KDETHL5XCT6RZN2BBNOCEXRZ2W3SFU3/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IK53GWZ475OQ6ENABKMJMTOBZG6LXUR/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MH6ALXEQXIFQRQFNJ5Y2MJ5DFPIX76VN/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RN7JGC2LVHPEGSJYODFUV5FEKPBVG4D7/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OGNAFVXSMTTT2UPH6CS3IH6L3KM42Q7/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3L6GDN5S5QZSCFKWD3GKL2RDZQ6B4UWA/	vendor-advisory

Impacted products

	Vendor	Product	Version
	prometheus	client_golang	Version: < 1.11.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:53:34.814Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/prometheus/client_golang/pull/962"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/prometheus/client_golang/pull/987"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/prometheus/client_golang/releases/tag/v1.11.1"
          },
          {
            "name": "FEDORA-2022-5f253807ce",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FY3N7H6VSDZM37B4SKM2PFFCUWU7QYWN/"
          },
          {
            "name": "FEDORA-2022-6c4cb64314",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKORFJTRRDJCWBTJPISKKCVMMMJBIRLG/"
          },
          {
            "name": "FEDORA-2022-eda0e65b01",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AK7CJBCGERCRXYUR2EWDSSDVAQMTAZGX/"
          },
          {
            "name": "FEDORA-2022-6043a7b938",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SASRKYHT5ZFSVMJUQUG3UAEQRJYGJKAR/"
          },
          {
            "name": "FEDORA-2022-e244ad73d6",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBMVIQFKQDSSTHVVJWJ4QH6TW3JVB7XZ/"
          },
          {
            "name": "FEDORA-2022-a7d438b30b",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V7I72LSQ3IET3QJR6QPAVGJZ4CBDLN5/"
          },
          {
            "name": "FEDORA-2022-83405f9d5b",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/"
          },
          {
            "name": "FEDORA-2022-9dd03cab55",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/"
          },
          {
            "name": "FEDORA-2022-c87047f163",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/"
          },
          {
            "name": "FEDORA-2022-2067702f06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KDETHL5XCT6RZN2BBNOCEXRZ2W3SFU3/"
          },
          {
            "name": "FEDORA-2022-c5383675d9",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/"
          },
          {
            "name": "FEDORA-2022-5e637f6cc6",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/"
          },
          {
            "name": "FEDORA-2022-396c568c5e",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IK53GWZ475OQ6ENABKMJMTOBZG6LXUR/"
          },
          {
            "name": "FEDORA-2022-92ef43c439",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MH6ALXEQXIFQRQFNJ5Y2MJ5DFPIX76VN/"
          },
          {
            "name": "FEDORA-2022-fae3ecee19",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/"
          },
          {
            "name": "FEDORA-2022-739c7a0058",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RN7JGC2LVHPEGSJYODFUV5FEKPBVG4D7/"
          },
          {
            "name": "FEDORA-2022-13ad572b5a",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OGNAFVXSMTTT2UPH6CS3IH6L3KM42Q7/"
          },
          {
            "name": "FEDORA-2022-741325e9a0",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3L6GDN5S5QZSCFKWD3GKL2RDZQ6B4UWA/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-21698",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:57:33.264502Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T19:05:16.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "client_golang",
          "vendor": "prometheus",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-14T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p"
        },
        {
          "url": "https://github.com/prometheus/client_golang/pull/962"
        },
        {
          "url": "https://github.com/prometheus/client_golang/pull/987"
        },
        {
          "url": "https://github.com/prometheus/client_golang/releases/tag/v1.11.1"
        },
        {
          "name": "FEDORA-2022-5f253807ce",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FY3N7H6VSDZM37B4SKM2PFFCUWU7QYWN/"
        },
        {
          "name": "FEDORA-2022-6c4cb64314",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKORFJTRRDJCWBTJPISKKCVMMMJBIRLG/"
        },
        {
          "name": "FEDORA-2022-eda0e65b01",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AK7CJBCGERCRXYUR2EWDSSDVAQMTAZGX/"
        },
        {
          "name": "FEDORA-2022-6043a7b938",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SASRKYHT5ZFSVMJUQUG3UAEQRJYGJKAR/"
        },
        {
          "name": "FEDORA-2022-e244ad73d6",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBMVIQFKQDSSTHVVJWJ4QH6TW3JVB7XZ/"
        },
        {
          "name": "FEDORA-2022-a7d438b30b",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V7I72LSQ3IET3QJR6QPAVGJZ4CBDLN5/"
        },
        {
          "name": "FEDORA-2022-83405f9d5b",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/"
        },
        {
          "name": "FEDORA-2022-9dd03cab55",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/"
        },
        {
          "name": "FEDORA-2022-c87047f163",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/"
        },
        {
          "name": "FEDORA-2022-2067702f06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KDETHL5XCT6RZN2BBNOCEXRZ2W3SFU3/"
        },
        {
          "name": "FEDORA-2022-c5383675d9",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/"
        },
        {
          "name": "FEDORA-2022-5e637f6cc6",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/"
        },
        {
          "name": "FEDORA-2022-396c568c5e",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IK53GWZ475OQ6ENABKMJMTOBZG6LXUR/"
        },
        {
          "name": "FEDORA-2022-92ef43c439",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MH6ALXEQXIFQRQFNJ5Y2MJ5DFPIX76VN/"
        },
        {
          "name": "FEDORA-2022-fae3ecee19",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/"
        },
        {
          "name": "FEDORA-2022-739c7a0058",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RN7JGC2LVHPEGSJYODFUV5FEKPBVG4D7/"
        },
        {
          "name": "FEDORA-2022-13ad572b5a",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OGNAFVXSMTTT2UPH6CS3IH6L3KM42Q7/"
        },
        {
          "name": "FEDORA-2022-741325e9a0",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3L6GDN5S5QZSCFKWD3GKL2RDZQ6B4UWA/"
        }
      ],
      "source": {
        "advisory": "GHSA-cg3q-j54f-5p7p",
        "discovery": "UNKNOWN"
      },
      "title": "Uncontrolled Resource Consumption in promhttp"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-21698",
    "datePublished": "2022-02-15T00:00:00.000Z",
    "dateReserved": "2021-11-16T00:00:00.000Z",
    "dateUpdated": "2025-04-23T19:05:16.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-30629 (GCVE-0-2022-30629)

Vulnerability from cvelistv5

Published

2022-08-09 20:17

Modified

2024-08-03 06:56

Severity ?

CWE

CWE-200: Information Exposure

Summary

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

References

►

URL

Tags

	https://go.dev/cl/405994
	https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5
	https://go.dev/issue/52814
	https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ
	https://pkg.go.dev/vuln/GO-2022-0531

Impacted products

	Vendor	Product	Version
	Go standard library	crypto/tls	Version: 0 ≤ Version: 1.18.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:13.230Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/405994"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/52814"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0531"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "serverHandshakeStateTLS13.sendSessionTickets"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.3",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Github user @nervuri"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200: Information Exposure",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:50.302Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/405994"
        },
        {
          "url": "https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5"
        },
        {
          "url": "https://go.dev/issue/52814"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0531"
        }
      ],
      "title": "Session tickets lack random ticket_age_add in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30629",
    "datePublished": "2022-08-09T20:17:31",
    "dateReserved": "2022-05-12T00:00:00",
    "dateUpdated": "2024-08-03T06:56:13.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2022:6430

Vulnerability from csaf_redhat

CVE-2022-30631 (GCVE-0-2022-30631)

Vulnerability from cvelistv5

CVE-2022-1962 (GCVE-0-2022-1962)

Vulnerability from cvelistv5

CVE-2022-1705 (GCVE-0-2022-1705)

Vulnerability from cvelistv5

CVE-2022-30630 (GCVE-0-2022-30630)

Vulnerability from cvelistv5

CVE-2022-24675 (GCVE-0-2022-24675)

Vulnerability from cvelistv5

CVE-2022-32148 (GCVE-0-2022-32148)

Vulnerability from cvelistv5

CVE-2022-21698 (GCVE-0-2022-21698)

Vulnerability from cvelistv5

CVE-2022-30629 (GCVE-0-2022-30629)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature