VDB
RHSA-2022%3A1051
RHSA-2022%3A1051
PUBLISHED
CVSS 7.5 HIGH
There's an uncontrolled resource consumption flaw in golang's net/http library in the canonicalHeader() function. An attacker who submits specially crafted requests to applications linked with net/http's http2 functionality could cause excessive resource consumption that could lead to a denial of service or otherwise impact to system performance and resources.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-serverless-1/eventing-sugar-controller-rhel8@sha256:57c414735b64642297d96d0caa57a8344d7ca2c333a13699a287fe27d49963b5_amd64 as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/eventing-sugar-controller-rhel8@sha256:57c414735b64642297d96d0caa57a8344d7ca2c333a13699a287fe27d49963b5_amd64 |
| Red Hat | openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:5aa222073a2a34b3f58c521c933b6b8d8c12e31e2de8c0fd704e265a5f09a3bc_amd64 as a component of Red Hat OpenShift Serverless 1.21 | * |
| Red Hat | openshift-serverless-1/eventing-mtbroker-filter-rhel8@sha256:d3e5032c8e585d3df400b0ef6a0330013d11b5cea369ad52c9e376eaab4edab7_ppc64le as a component of Red Hat OpenShift Serverless 1.21 | * |
| Red Hat | openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:9087238df7e9f5662b328921d43d2be0dd6342c8ea93dca23d6a0f8ddefb047b_s390x as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:9087238df7e9f5662b328921d43d2be0dd6342c8ea93dca23d6a0f8ddefb047b_s390x |
| Red Hat | openshift-serverless-1/serving-storage-version-migration-rhel8@sha256:b11b45a36f3ffa0bc09bb894c871f8c685b0e3bb5ed20801de5ac802f2457f67_ppc64le as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/serving-storage-version-migration-rhel8@sha256:b11b45a36f3ffa0bc09bb894c871f8c685b0e3bb5ed20801de5ac802f2457f67_ppc64le |
| Red Hat | openshift-serverless-1/net-istio-webhook-rhel8@sha256:3bd9db04de20a6565c4bb93559ef680ac5ebc8ac5e8874a84e6d72073333252c_amd64 as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/net-istio-webhook-rhel8@sha256:3bd9db04de20a6565c4bb93559ef680ac5ebc8ac5e8874a84e6d72073333252c_amd64 |
| Red Hat | openshift-serverless-1/eventing-storage-version-migration-rhel8@sha256:45d92141e102756d0acf33e62f52e7c4eaef7de85dfb8436d86aaf1858690e6e_s390x as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/eventing-storage-version-migration-rhel8@sha256:45d92141e102756d0acf33e62f52e7c4eaef7de85dfb8436d86aaf1858690e6e_s390x |
| Red Hat | openshift-serverless-1/eventing-controller-rhel8@sha256:9825ecd29f75d4dd9f680f34fe8ca86ff56d3deb6fc3b10307f534596fed7241_s390x as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/eventing-controller-rhel8@sha256:9825ecd29f75d4dd9f680f34fe8ca86ff56d3deb6fc3b10307f534596fed7241_s390x |
| Red Hat | openshift-serverless-1/serving-controller-rhel8@sha256:a387283dc0be5afa5682869fe1b30021d876033dcaa3e2e013349b9f56be5664_amd64 as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/serving-controller-rhel8@sha256:a387283dc0be5afa5682869fe1b30021d876033dcaa3e2e013349b9f56be5664_amd64 |
| Red Hat | openshift-serverless-1/serving-queue-rhel8@sha256:29e1bd9badf6f819974138cc78ea27f3e2d4df00ee3abde3b301a5ec5c592526_s390x as a component of Red Hat OpenShift Serverless 1.21 | * |
| Red Hat | openshift-serverless-1/serving-autoscaler-rhel8@sha256:5c362187f97914cbed43d42074731dff55dfa7d3484d3f9aa71c28d45f1e0ad1_s390x as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/serving-autoscaler-rhel8@sha256:5c362187f97914cbed43d42074731dff55dfa7d3484d3f9aa71c28d45f1e0ad1_s390x |
| Red Hat | openshift-serverless-1/kourier-control-rhel8@sha256:ea87dbb880dc8be505c84249b69a0b2ae0e3e5357384a24d46382e03bbc392f6_ppc64le as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/kourier-control-rhel8@sha256:ea87dbb880dc8be505c84249b69a0b2ae0e3e5357384a24d46382e03bbc392f6_ppc64le |
| Red Hat | openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:cbe8c10bf58a60e0e34a548bf17c9f13911774330b2440c8c69634b2ceb6e1db_amd64 as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:cbe8c10bf58a60e0e34a548bf17c9f13911774330b2440c8c69634b2ceb6e1db_amd64 |
| Red Hat | openshift-serverless-1/eventing-mtbroker-ingress-rhel8@sha256:a8b3e04178b102325959447e178974a4250423487a1790efbbfdf003d63c03a0_s390x as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/eventing-mtbroker-ingress-rhel8@sha256:a8b3e04178b102325959447e178974a4250423487a1790efbbfdf003d63c03a0_s390x |
| Red Hat | openshift-serverless-1/eventing-mtping-rhel8@sha256:e3f4d0b8c9f5b0181650e0d2f65ab8a4ccaed01d8f4e0ba208f63d5965c057d6_amd64 as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/eventing-mtping-rhel8@sha256:e3f4d0b8c9f5b0181650e0d2f65ab8a4ccaed01d8f4e0ba208f63d5965c057d6_amd64 |
| Red Hat | openshift-serverless-1/serving-webhook-rhel8@sha256:4dc055e7f3e1f0ce73d184d272b8fb88b23df6bb58b131f754680e9552d7447b_s390x as a component of Red Hat OpenShift Serverless 1.21 | * |
| Red Hat | openshift-serverless-1/serving-domain-mapping-rhel8@sha256:e94d5a518e383f1a832cdca38ed89fedfee503c88a901f2190cb6760bfc8f376_amd64 as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/serving-domain-mapping-rhel8@sha256:e94d5a518e383f1a832cdca38ed89fedfee503c88a901f2190cb6760bfc8f376_amd64 |
| Red Hat | openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8@sha256:175516a2854b52f7af6a758a51b2fe5bac1fb039bf7d8653b107d5d66a4c79e0_s390x as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8@sha256:175516a2854b52f7af6a758a51b2fe5bac1fb039bf7d8653b107d5d66a4c79e0_s390x |
| Red Hat | openshift-serverless-1/eventing-mtping-rhel8@sha256:01ae54bb0e9d32610c6ecee997b30f2fa2943ec8cff91c4213eecb139b2f535f_ppc64le as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/eventing-mtping-rhel8@sha256:01ae54bb0e9d32610c6ecee997b30f2fa2943ec8cff91c4213eecb139b2f535f_ppc64le |
| Red Hat | openshift-serverless-1/serving-storage-version-migration-rhel8@sha256:31be91cc5c40ac8d53e74428dc5a8c7e0abf6e73fc4b3fce3a394a18cc4f8731_s390x as a component of Red Hat OpenShift Serverless 1.21 | openshift-serverless-1/serving-storage-version-migration-rhel8@sha256:31be91cc5c40ac8d53e74428dc5a8c7e0abf6e73fc4b3fce3a394a18cc4f8731_s390x |
…and 80 more
Timeline
- Mar 24, 2022 CVE Published
- Mar 27, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2022:1051 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2030801 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2030806 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2054720 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2054721 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1051.json advisory
- https://access.redhat.com/security/cve/CVE-2021-44716 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-44716 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-44716 advisory
- https://groups.google.com/g/golang-announce/c/hcmEScgc00k advisory
- https://access.redhat.com/security/cve/CVE-2021-44717 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-44717 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-44717 advisory