VDB

RHSA-2022%3A8609

RHSA-2022%3A8609 PUBLISHED CVSS 9.100000381469727 CRITICAL

A flaw was found in CORS Filter feature from the go-restful package. When a user inputs a domain which is in AllowedDomains, all domains starting with the same pattern are accepted. This issue could allow an attacker to break the CORS policy by allowing any page to make requests and retrieve data on behalf of users.

Risk Scores

CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

VendorProductVersions
Red Hatcontainer-native-virtualization/virt-cdi-apiserver@sha256:a9767ca3a53e0dab656d334cc97e9496f40ab82535bdceec320c5048e6de89c8_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/virt-cdi-apiserver@sha256:a9767ca3a53e0dab656d334cc97e9496f40ab82535bdceec320c5048e6de89c8_amd64
Red Hatcontainer-native-virtualization/libguestfs-tools@sha256:8abb932a507e2db69b68127a290a830878a3542f0b6816efa18ffeee91b189db_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/libguestfs-tools@sha256:8abb932a507e2db69b68127a290a830878a3542f0b6816efa18ffeee91b189db_amd64
Red Hatcontainer-native-virtualization/virt-cdi-controller@sha256:0e26d1b45c7bf62470d14c01d75d9de349239e8450888017209ca496985457c0_amd64 as a component of CNV 4.9 for RHEL 8*
Red Hatcontainer-native-virtualization/hco-bundle-registry@sha256:eb1542e163a1e119457c1468accf8f60a0b5a934d9059728e6059ad4f2b24cf0_amd64 as a component of CNV 4.9 for RHEL 8*
Red Hatcontainer-native-virtualization/ovs-cni-marker@sha256:26ab4f997a9679a0316bb5b3f7fd4336e42737ac221b38500b24cebe07dbf037_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/ovs-cni-marker@sha256:26ab4f997a9679a0316bb5b3f7fd4336e42737ac221b38500b24cebe07dbf037_amd64
Red Hatcontainer-native-virtualization/vm-import-virtv2v-rhel8@sha256:4efa6304395bf177335cbc7a2c9d3f56b4ee4a5979591834a9b46281aadae24e_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/vm-import-virtv2v-rhel8@sha256:4efa6304395bf177335cbc7a2c9d3f56b4ee4a5979591834a9b46281aadae24e_amd64
Red Hatcontainer-native-virtualization/virt-cdi-uploadproxy@sha256:e75699436dad9bdaa192c4574e9fcab781566d326df66c17146c304f05f361a1_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/virt-cdi-uploadproxy@sha256:e75699436dad9bdaa192c4574e9fcab781566d326df66c17146c304f05f361a1_amd64
Red Hatcontainer-native-virtualization/virt-launcher@sha256:1eaacff0e54e7b46740868f53e9095ca483785621c36d748730201057e4b44ea_amd64 as a component of CNV 4.9 for RHEL 8*
Red Hatcontainer-native-virtualization/virt-cdi-cloner@sha256:23cbe943a4b21b2226b4e8f638b17a45fc306b19f06f1c67a23768abfeca2e87_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/virt-cdi-cloner@sha256:23cbe943a4b21b2226b4e8f638b17a45fc306b19f06f1c67a23768abfeca2e87_amd64
Red Hatcontainer-native-virtualization/virt-controller@sha256:aa2e77638b4934b2c03a79d1e7eb52463fb9a477ab2a355c45df62abdba2eb04_amd64 as a component of CNV 4.9 for RHEL 8*
Red Hatcontainer-native-virtualization/ovs-cni-plugin@sha256:ae35f9d9c9a31d54e005009f70e9317d3f57fd71cacaa7919e534d6e16bd485a_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/ovs-cni-plugin@sha256:ae35f9d9c9a31d54e005009f70e9317d3f57fd71cacaa7919e534d6e16bd485a_amd64
Red Hatcontainer-native-virtualization/virt-api@sha256:37ebc772387b400029c0c15cf564dfb3b9d9478e7354522e6038cb98cd42303e_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/virt-api@sha256:37ebc772387b400029c0c15cf564dfb3b9d9478e7354522e6038cb98cd42303e_amd64
Red Hatcontainer-native-virtualization/virt-artifacts-server@sha256:7ed7085b8c1266553a0fcc2a52fd03f4139d2929dc05885b3c4b8c2b5809e000_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/virt-artifacts-server@sha256:7ed7085b8c1266553a0fcc2a52fd03f4139d2929dc05885b3c4b8c2b5809e000_amd64
Red Hatcontainer-native-virtualization/kubernetes-nmstate-handler-rhel8@sha256:c79fbbe514a1879cc33eaf16225d56fe8d15b14bf2f334c7e82861298b63da85_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/kubernetes-nmstate-handler-rhel8@sha256:c79fbbe514a1879cc33eaf16225d56fe8d15b14bf2f334c7e82861298b63da85_amd64
Red Hatcontainer-native-virtualization/virt-cdi-uploadserver@sha256:45e423cc38118b03fd694006b8aa284b4724083d0e1757b1f76420f00696675c_amd64 as a component of CNV 4.9 for RHEL 8*
Red Hatcontainer-native-virtualization/cnv-containernetworking-plugins@sha256:b5b65faeedf99f08ca151552678dde8348292b97cfdfb1d2fef89ef8390c8a12_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/cnv-containernetworking-plugins@sha256:b5b65faeedf99f08ca151552678dde8348292b97cfdfb1d2fef89ef8390c8a12_amd64
Red Hatcontainer-native-virtualization/virt-cdi-operator@sha256:59063046badee8e32d93a11a66de46c2a571705947f5227c8e5527c3d35e1f47_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/virt-cdi-operator@sha256:59063046badee8e32d93a11a66de46c2a571705947f5227c8e5527c3d35e1f47_amd64
Red Hatcontainer-native-virtualization/cnv-must-gather-rhel8@sha256:db3d06df3dab3a08dd3c404a61c616ad5b7ab3972109fd9ef72a9acf309cfdb6_amd64 as a component of CNV 4.9 for RHEL 8*
Red Hatcontainer-native-virtualization/vm-import-controller-rhel8@sha256:424b4a3bb2dea65e990f1132aeed52683bc6daae1d8cb1e0a11a228a66e2e156_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/vm-import-controller-rhel8@sha256:424b4a3bb2dea65e990f1132aeed52683bc6daae1d8cb1e0a11a228a66e2e156_amd64
Red Hatcontainer-native-virtualization/bridge-marker@sha256:95f6b48f3b497ff38ce618b7461d415b8b1c93822dac22635ee72b7189f61489_amd64 as a component of CNV 4.9 for RHEL 8container-native-virtualization/bridge-marker@sha256:95f6b48f3b497ff38ce618b7461d415b8b1c93822dac22635ee72b7189f61489_amd64

…and 16 more

Timeline

  • Nov 22, 2022 CVE Published
  • Feb 24, 2026 CVE Updated
  • May 1, 2026 Distribution Patch
  • May 1, 2026 Distribution Patch
  • May 1, 2026 Security Advisory
  • May 1, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›