VDB
RHSA-2023%3A0632
RHSA-2023%3A0632
PUBLISHED
CVSS 10 CRITICAL
A flaw was found in ruby gem-rack. This flaw allows a malicious actor to craft requests that can cause shell escape sequences to be written to the terminal via rack's `Lint` middleware and `CommonLogger` middleware. This issue can leverage these escape sequences to execute commands in the victim's terminal.
Risk Scores
CVSS 3.1
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-logging/cluster-logging-rhel8-operator@sha256:6852056797fb71905807c327c6eb360ba8c21eaca7d6a56db3fdd40fb1ca8c91_arm64 as a component of RHOL 5.4 for RHEL 8 | openshift-logging/cluster-logging-rhel8-operator@sha256:6852056797fb71905807c327c6eb360ba8c21eaca7d6a56db3fdd40fb1ca8c91_arm64 |
| Red Hat | openshift-logging/log-file-metric-exporter-rhel8@sha256:989592f347cbca72cd3ac0331b385265d30320656ba79ceece673edd6bc7872d_s390x as a component of RHOL 5.4 for RHEL 8 | openshift-logging/log-file-metric-exporter-rhel8@sha256:989592f347cbca72cd3ac0331b385265d30320656ba79ceece673edd6bc7872d_s390x |
| Red Hat | openshift-logging/eventrouter-rhel8@sha256:ecdcab4b6b5192f87209973f9634937b05d3916e5a21fb3be4c75cf40cacaf74_amd64 as a component of RHOL 5.4 for RHEL 8 | openshift-logging/eventrouter-rhel8@sha256:ecdcab4b6b5192f87209973f9634937b05d3916e5a21fb3be4c75cf40cacaf74_amd64 |
| Red Hat | openshift-logging/loki-rhel8-operator@sha256:421f77e65c0d8130c762883c25c5d00879e57266278100424d2693eb3946c1f0_amd64 as a component of RHOL 5.4 for RHEL 8 | openshift-logging/loki-rhel8-operator@sha256:421f77e65c0d8130c762883c25c5d00879e57266278100424d2693eb3946c1f0_amd64 |
| Red Hat | openshift-logging/lokistack-gateway-rhel8@sha256:135fd57e3246485140a76d44db6a0337b51c7739af3a115002f898b54b2d56c8_arm64 as a component of RHOL 5.4 for RHEL 8 | openshift-logging/lokistack-gateway-rhel8@sha256:135fd57e3246485140a76d44db6a0337b51c7739af3a115002f898b54b2d56c8_arm64 |
| Red Hat | openshift-logging/elasticsearch-rhel8-operator@sha256:f7b3d237c663055b328ecd74bcce5187adc19bdbe37d2fdd6da568a2160ddfce_s390x as a component of RHOL 5.4 for RHEL 8 | openshift-logging/elasticsearch-rhel8-operator@sha256:f7b3d237c663055b328ecd74bcce5187adc19bdbe37d2fdd6da568a2160ddfce_s390x |
| Red Hat | openshift-logging/kibana6-rhel8@sha256:6c20722e93575354d264f7df0a7ad176ee0176966ec1da1be2bb8c5157c81364_arm64 as a component of RHOL 5.4 for RHEL 8 | * |
| Red Hat | openshift-logging/cluster-logging-rhel8-operator@sha256:1b8bf87ec875fe41a66ea659a6b18c5e5659b316d45eea5ebdee33bae4ef81a1_s390x as a component of RHOL 5.4 for RHEL 8 | openshift-logging/cluster-logging-rhel8-operator@sha256:1b8bf87ec875fe41a66ea659a6b18c5e5659b316d45eea5ebdee33bae4ef81a1_s390x |
| Red Hat | openshift-logging/eventrouter-rhel8@sha256:288436122a88e3774ed1f67340701552853622ff3d7e93df79064aafc93793a5_arm64 as a component of RHOL 5.4 for RHEL 8 | * |
| Red Hat | openshift-logging/logging-loki-rhel8@sha256:788bdc53fc2804979ef5de471175aaf572cdfd36a1ec0b1d0081073549e88f4b_s390x as a component of RHOL 5.4 for RHEL 8 | * |
| Red Hat | openshift-logging/log-file-metric-exporter-rhel8@sha256:2fc648617368a8be448ac85fed88c0701fe49975aea66d647739f91e44731065_arm64 as a component of RHOL 5.4 for RHEL 8 | openshift-logging/log-file-metric-exporter-rhel8@sha256:2fc648617368a8be448ac85fed88c0701fe49975aea66d647739f91e44731065_arm64 |
| Red Hat | openshift-logging/lokistack-gateway-rhel8@sha256:0461e5c960e044fe9eb89532d90af2c68c2577ab7599ff700077ba383a2c4b79_s390x as a component of RHOL 5.4 for RHEL 8 | openshift-logging/lokistack-gateway-rhel8@sha256:0461e5c960e044fe9eb89532d90af2c68c2577ab7599ff700077ba383a2c4b79_s390x |
| Red Hat | openshift-logging/vector-rhel8@sha256:fe020a4c315486f3e90534cdce69d336a1ee08289e9c0773a9100a593c98bea1_arm64 as a component of RHOL 5.4 for RHEL 8 | * |
| Red Hat | openshift-logging/cluster-logging-rhel8-operator@sha256:b7d74ad5055cde7320b9584fab00b35790034b5946ab5e5b3bb91b9dd53ba5ac_amd64 as a component of RHOL 5.4 for RHEL 8 | openshift-logging/cluster-logging-rhel8-operator@sha256:b7d74ad5055cde7320b9584fab00b35790034b5946ab5e5b3bb91b9dd53ba5ac_amd64 |
| Red Hat | openshift-logging/lokistack-gateway-rhel8@sha256:135fd57e3246485140a76d44db6a0337b51c7739af3a115002f898b54b2d56c8_arm64 as a component of RHOL 5.4 for RHEL 8 | openshift-logging/lokistack-gateway-rhel8@sha256:135fd57e3246485140a76d44db6a0337b51c7739af3a115002f898b54b2d56c8_arm64 |
| Red Hat | openshift-logging/lokistack-gateway-rhel8@sha256:0461e5c960e044fe9eb89532d90af2c68c2577ab7599ff700077ba383a2c4b79_s390x as a component of RHOL 5.4 for RHEL 8 | openshift-logging/lokistack-gateway-rhel8@sha256:0461e5c960e044fe9eb89532d90af2c68c2577ab7599ff700077ba383a2c4b79_s390x |
| Red Hat | openshift-logging/logging-curator5-rhel8@sha256:b864f913045f32c221b30e9739f0609cc2700474535060bb503429ddf360d59d_arm64 as a component of RHOL 5.4 for RHEL 8 | openshift-logging/logging-curator5-rhel8@sha256:b864f913045f32c221b30e9739f0609cc2700474535060bb503429ddf360d59d_arm64 |
| Red Hat | openshift-logging/loki-rhel8-operator@sha256:4a10b28997798c6da95190e2caca50b138f7508e52237e605c498858749b4c69_ppc64le as a component of RHOL 5.4 for RHEL 8 | openshift-logging/loki-rhel8-operator@sha256:4a10b28997798c6da95190e2caca50b138f7508e52237e605c498858749b4c69_ppc64le |
| Red Hat | openshift-logging/vector-rhel8@sha256:f98f732a7e82778aed2b0d0fb88a36d69e8cf2852d270d3e47e120b529a885d4_s390x as a component of RHOL 5.4 for RHEL 8 | openshift-logging/vector-rhel8@sha256:f98f732a7e82778aed2b0d0fb88a36d69e8cf2852d270d3e47e120b529a885d4_s390x |
| Red Hat | openshift-logging/loki-operator-bundle@sha256:36b7aca216180137eb518c35bba4e94d0260cbdbca6e26cfb4932d73d13f3401_amd64 as a component of RHOL 5.4 for RHEL 8 | openshift-logging/loki-operator-bundle@sha256:36b7aca216180137eb518c35bba4e94d0260cbdbca6e26cfb4932d73d13f3401_amd64 |
…and 98 more
Timeline
- Feb 15, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:0632 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2099524 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2161274 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0632.json advisory
- https://access.redhat.com/security/cve/CVE-2022-30123 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-30123 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-30123 advisory
- https://github.com/advisories/GHSA-wq4h-7r42-5hrr advisory
- https://access.redhat.com/security/cve/CVE-2022-41717 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-41717 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-41717 advisory
- https://go.dev/cl/455635 advisory
- https://go.dev/cl/455717 advisory
- https://go.dev/issue/56350 advisory
- https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ advisory
- https://pkg.go.dev/vuln/GO-2022-1144 advisory