VDB
RHSA-2021%3A2705
RHSA-2021%3A2705
PUBLISHED
CVSS 7.5 HIGH
An infinite loop vulnerability was found in golang. If an application defines a custom token parser initializing with `xml.NewTokenDecoder` it is possible for the parsing loop to never return. An attacker could potentially craft a malicious XML document which has an XML element with `EOF` within it, causing the parsing application to endlessly loop, resulting in a Denial of Service (DoS).
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-serverless-1/eventing-controller-rhel8@sha256:5edfa95b4adaf5bebda75b9a01b33ea1b9f170a8a4225f9045aae30d33f5e21c_ppc64le as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/eventing-controller-rhel8@sha256:5edfa95b4adaf5bebda75b9a01b33ea1b9f170a8a4225f9045aae30d33f5e21c_ppc64le |
| Red Hat | openshift-serverless-1/serving-storage-version-migration-rhel8@sha256:70d4d795e7c883a412f319cf78aef9c080d78d340520c2948193d95cec45500b_ppc64le as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/serving-storage-version-migration-rhel8@sha256:70d4d795e7c883a412f319cf78aef9c080d78d340520c2948193d95cec45500b_ppc64le |
| Red Hat | openshift-serverless-1/serving-queue-rhel8@sha256:dc610c3c175b4634b6b85c0d3dc7364856f22bda5540468543641aaed4ec9c9f_s390x as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/serving-queue-rhel8@sha256:dc610c3c175b4634b6b85c0d3dc7364856f22bda5540468543641aaed4ec9c9f_s390x |
| Red Hat | openshift-serverless-1/serving-domain-mapping-rhel8@sha256:62b6bee16f5ad365c3e87b190855f8697c12e5dfe8a70c908a3345fbadd72540_s390x as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/serving-domain-mapping-rhel8@sha256:62b6bee16f5ad365c3e87b190855f8697c12e5dfe8a70c908a3345fbadd72540_s390x |
| Red Hat | openshift-serverless-1/net-istio-webhook-rhel8@sha256:b8bf79102c15f05be93efd996d54f24b0393c61cd5a66c2c0f6b75214997cf89_s390x as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/net-istio-webhook-rhel8@sha256:b8bf79102c15f05be93efd996d54f24b0393c61cd5a66c2c0f6b75214997cf89_s390x |
| Red Hat | openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:7919210c38d4e684b66826f9ac97b4d46ca3877ad4d0c14ed75408b1f8d5299f_amd64 as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:7919210c38d4e684b66826f9ac97b4d46ca3877ad4d0c14ed75408b1f8d5299f_amd64 |
| Red Hat | openshift-serverless-1/serving-activator-rhel8@sha256:81c5483bd8c248b6b4fb9dbeb24ddf12496531774332a3c6b33f34471713fb53_s390x as a component of Red Hat OpenShift Serverless 1.16 | * |
| Red Hat | openshift-serverless-1/kourier-control-rhel8@sha256:164d9a395835ba419866acf959dcbe0cdba718e9f80848e6da28c06ec11176f6_ppc64le as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/kourier-control-rhel8@sha256:164d9a395835ba419866acf959dcbe0cdba718e9f80848e6da28c06ec11176f6_ppc64le |
| Red Hat | openshift-serverless-1/eventing-sugar-controller-rhel8@sha256:4216b1d4106a68b90b73a0d176527497212f7440c912291c44602551a0ad110a_amd64 as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/eventing-sugar-controller-rhel8@sha256:4216b1d4106a68b90b73a0d176527497212f7440c912291c44602551a0ad110a_amd64 |
| Red Hat | openshift-serverless-1/eventing-webhook-rhel8@sha256:152f331fe988ee24cfcf4a4dd924efaadb9da3558cfc00f44bbd3430c65c61a3_amd64 as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/eventing-webhook-rhel8@sha256:152f331fe988ee24cfcf4a4dd924efaadb9da3558cfc00f44bbd3430c65c61a3_amd64 |
| Red Hat | openshift-serverless-1/serving-webhook-rhel8@sha256:2cf4d5aae44791dfab21f77ba9c6b349b94b458526e361b1f1fc1715277d60af_amd64 as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/serving-webhook-rhel8@sha256:2cf4d5aae44791dfab21f77ba9c6b349b94b458526e361b1f1fc1715277d60af_amd64 |
| Red Hat | openshift-serverless-1/serving-autoscaler-hpa-rhel8@sha256:0a3f9d8474b78fe867dfcbca13c21fd8b41bb63372b6a4ebd3cfc65995a8f207_s390x as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/serving-autoscaler-hpa-rhel8@sha256:0a3f9d8474b78fe867dfcbca13c21fd8b41bb63372b6a4ebd3cfc65995a8f207_s390x |
| Red Hat | openshift-serverless-1/eventing-controller-rhel8@sha256:356a15345f3473c2361d2be1f9bff8d79d09d4eb1024cb8de7cae98df855e69c_amd64 as a component of Red Hat OpenShift Serverless 1.16 | * |
| Red Hat | openshift-serverless-1/svls-must-gather-rhel8@sha256:1ecc8287f0b7943b6db606145f137c0f7a961e4371216dd7e97fdaff105617cf_s390x as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/svls-must-gather-rhel8@sha256:1ecc8287f0b7943b6db606145f137c0f7a961e4371216dd7e97fdaff105617cf_s390x |
| Red Hat | openshift-serverless-1/knative-rhel8-operator@sha256:e78bc3a8109979984348b8eb2842f7b00c95657f6ed226ba3e5ba7de702d98ad_ppc64le as a component of Red Hat OpenShift Serverless 1.16 | * |
| Red Hat | openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:90621924813d8876acdbbad612cf824660ff1146cc0c02cd0ef837fd7b8325a2_amd64 as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:90621924813d8876acdbbad612cf824660ff1146cc0c02cd0ef837fd7b8325a2_amd64 |
| Red Hat | openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:1958b772192cac8157250fbb30943f6ccf104bde5e3ee681e303c331abc12485_ppc64le as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:1958b772192cac8157250fbb30943f6ccf104bde5e3ee681e303c331abc12485_ppc64le |
| Red Hat | openshift-serverless-1/eventing-sugar-controller-rhel8@sha256:a62f1428a4649813db23ced5d0307981efd346311473965cb9095a31ecb8ca98_ppc64le as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/eventing-sugar-controller-rhel8@sha256:a62f1428a4649813db23ced5d0307981efd346311473965cb9095a31ecb8ca98_ppc64le |
| Red Hat | openshift-serverless-1/serving-autoscaler-rhel8@sha256:b3453234fe414a73f2c4d53fefa785fb79fe5647e3340f7b15d4a1f271ab7d8d_ppc64le as a component of Red Hat OpenShift Serverless 1.16 | openshift-serverless-1/serving-autoscaler-rhel8@sha256:b3453234fe414a73f2c4d53fefa785fb79fe5647e3340f7b15d4a1f271ab7d8d_ppc64le |
| Red Hat | openshift-serverless-1/svls-must-gather-rhel8@sha256:e1fc67c5720e9410d6c3d16ed815a779d2fc2cfeb02b95ce9f54cd115847fc4b_ppc64le as a component of Red Hat OpenShift Serverless 1.16 | * |
…and 68 more
Timeline
- Jul 13, 2021 CVE Published
- Mar 19, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2021:2705 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1937901 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1958341 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1965503 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1971445 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1971448 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2705.json advisory
- https://access.redhat.com/security/cve/CVE-2021-27918 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-27918 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-27918 advisory
- https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw advisory
- https://access.redhat.com/security/cve/CVE-2021-31525 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-31525 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-31525 advisory
- https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc advisory
- https://access.redhat.com/security/cve/CVE-2021-33196 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-33196 advisory
…and 2 more