VDB
RHSA-2022%3A9108
RHSA-2022%3A9108
PUBLISHED
CVSS 9.100000381469727 CRITICAL
An authentication bypass flaw was discovered in the crewjam/saml go package. A remote unauthenticated attacker could trigger it by sending a SAML request. This would allow an escalation of privileges and then enable compromising system integrity.
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-service-idler-rhel8@sha256:bc9b22312443ec544796a5ad61f6c733192b805207944589c3bdeeb1b6e7cb0d_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-service-idler-rhel8@sha256:bc9b22312443ec544796a5ad61f6c733192b805207944589c3bdeeb1b6e7cb0d_arm64 |
| Red Hat | openshift4/ose-cloud-event-proxy-rhel8@sha256:07d9839ea3ad71c0282de380e64375d5bf7f7af423814823152600af0f9264a5_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cloud-event-proxy-rhel8@sha256:07d9839ea3ad71c0282de380e64375d5bf7f7af423814823152600af0f9264a5_arm64 |
| Red Hat | openshift4/ose-descheduler@sha256:131354a6aab99c556c5926f45fb5747e28a23ce2ebfe9e635cdcd2d5708b29d1_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-descheduler@sha256:131354a6aab99c556c5926f45fb5747e28a23ce2ebfe9e635cdcd2d5708b29d1_ppc64le |
| Red Hat | openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:62aad62d133d941d3f7889e583c57b993f2497957a3f265122287bdf6fbc63ab_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:62aad62d133d941d3f7889e583c57b993f2497957a3f265122287bdf6fbc63ab_arm64 |
| Red Hat | openshift-tech-preview/metallb-rhel8@sha256:7e6b9a992d26f5d360e92466b0da5032b6c7aca784391f785ab25c8df3622f37_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | openshift-tech-preview/metallb-rhel8@sha256:7e6b9a992d26f5d360e92466b0da5032b6c7aca784391f785ab25c8df3622f37_ppc64le |
| Red Hat | openshift4/ose-openshift-proxy-pull-test-rhel8@sha256:c230df14eba9c69072b23d63e3fb06b5feaed4b43f5eb5ad2d6f9cb0d9bf4c6e_s390x as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-openshift-proxy-pull-test-rhel8@sha256:c230df14eba9c69072b23d63e3fb06b5feaed4b43f5eb5ad2d6f9cb0d9bf4c6e_s390x |
| Red Hat | openshift-tech-preview/metallb-rhel8@sha256:de0bdf8925b2f9b8c9b8c1dbfff08cbf7bfc56ad40f081b611684005ff3b1e58_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift-tech-preview/metallb-rhel8@sha256:de0bdf8925b2f9b8c9b8c1dbfff08cbf7bfc56ad40f081b611684005ff3b1e58_amd64 |
| Red Hat | openshift4/ose-descheduler@sha256:33e8fa8b146f403e4532012de85c4022441ec3afb88e87b09a64bc5b3d30fbc1_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | * |
| Red Hat | openshift4/ose-cloud-event-proxy@sha256:2333a9deaba06a49d0b4149b74a7948aa624246e5cdc8a2a9d59587055dc7917_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cloud-event-proxy@sha256:2333a9deaba06a49d0b4149b74a7948aa624246e5cdc8a2a9d59587055dc7917_amd64 |
| Red Hat | openshift4/ose-cluster-kube-descheduler-operator@sha256:3fb9fa446f384c2e435c45d977cad12abd92da6d676dec3a8c6b163023ca691b_s390x as a component of Red Hat OpenShift Container Platform 4.11 | * |
| Red Hat | openshift4/ose-openshift-proxy-pull-test-rhel8@sha256:5f0976c6ad2941126444ff04ef22be1130f001cad33d83b07e3283acef3c33e9_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | * |
| Red Hat | openshift4/metallb-rhel8@sha256:e66e92cfc5b6219f46d71255d8e3d4751566dd7c04f700fee1168ed0ccb17c98_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/metallb-rhel8@sha256:e66e92cfc5b6219f46d71255d8e3d4751566dd7c04f700fee1168ed0ccb17c98_arm64 |
| Red Hat | openshift-tech-preview/metallb-rhel8@sha256:e66e92cfc5b6219f46d71255d8e3d4751566dd7c04f700fee1168ed0ccb17c98_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift-tech-preview/metallb-rhel8@sha256:e66e92cfc5b6219f46d71255d8e3d4751566dd7c04f700fee1168ed0ccb17c98_arm64 |
| Red Hat | openshift4/ose-local-storage-mustgather-rhel8@sha256:002d66997ec1f253bc560a16168f04d45f7e35cc2172b8367968f7795ed3c731_s390x as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-local-storage-mustgather-rhel8@sha256:002d66997ec1f253bc560a16168f04d45f7e35cc2172b8367968f7795ed3c731_s390x |
| Red Hat | openshift4/ose-openshift-proxy-pull-test-rhel8@sha256:332b8fa153cc3e3cf8014323be7975be70d461034d48357e8d7d22d22175ca40_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-openshift-proxy-pull-test-rhel8@sha256:332b8fa153cc3e3cf8014323be7975be70d461034d48357e8d7d22d22175ca40_arm64 |
| Red Hat | openshift4/metallb-rhel8-operator@sha256:3f4a9f224416587d93cc6d800bdb36364e90f3c872d1f7eda3fc6ec57544622c_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/metallb-rhel8-operator@sha256:3f4a9f224416587d93cc6d800bdb36364e90f3c872d1f7eda3fc6ec57544622c_amd64 |
| Red Hat | openshift4/ose-kubernetes-nmstate-handler-rhel8@sha256:3f37cc4d3f7752396d93b42eb3c74520c126f1fb6ad3cf6f5d92bddf06ddc2f8_s390x as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-kubernetes-nmstate-handler-rhel8@sha256:3f37cc4d3f7752396d93b42eb3c74520c126f1fb6ad3cf6f5d92bddf06ddc2f8_s390x |
| Red Hat | openshift4/ose-grafana@sha256:43c451e240f7e1890f60751458901c5286c9d7799fed40da40ce3dc717360874_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-grafana@sha256:43c451e240f7e1890f60751458901c5286c9d7799fed40da40ce3dc717360874_arm64 |
| Red Hat | openshift4/ose-cloud-event-proxy-rhel8@sha256:2333a9deaba06a49d0b4149b74a7948aa624246e5cdc8a2a9d59587055dc7917_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cloud-event-proxy-rhel8@sha256:2333a9deaba06a49d0b4149b74a7948aa624246e5cdc8a2a9d59587055dc7917_amd64 |
| Red Hat | openshift4/cloud-event-proxy-rhel8@sha256:2333a9deaba06a49d0b4149b74a7948aa624246e5cdc8a2a9d59587055dc7917_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/cloud-event-proxy-rhel8@sha256:2333a9deaba06a49d0b4149b74a7948aa624246e5cdc8a2a9d59587055dc7917_amd64 |
…and 44 more
Timeline
- Jan 4, 2023 CVE Published
- Mar 21, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2022:9108 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2149181 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2022_9108.json advisory
- https://access.redhat.com/security/cve/CVE-2022-41912 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-41912 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-41912 advisory
- https://github.com/crewjam/saml/security/advisories/GHSA-j2jp-wvqg-wc2g advisory