VDB
RHSA-2023%3A0709
RHSA-2023%3A0709
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw allows a maliciously crafted archive to cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panic.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-serverless-1/serving-domain-mapping-webhook-rhel8@sha256:739bfcbd169585aae228b7193dc0c5c6b19bcb790817c79d99e8441ed93e2caa_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | *, openshift-serverless-1/serving-domain-mapping-webhook-rhel8@sha256:739bfcbd169585aae228b7193dc0c5c6b19bcb790817c79d99e8441ed93e2caa_ppc64le, openshift-serverless-1/serving-domain-mapping-webhook-rhel8@sha256:739bfcbd169585aae228b7193dc0c5c6b19bcb790817c79d99e8441ed93e2caa_ppc64le |
| Red Hat | openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:53da51f3aae7f380b7a76fc074c1fa1f4c81ee627a7cb469713ef17764073ba2_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | *, openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:53da51f3aae7f380b7a76fc074c1fa1f4c81ee627a7cb469713ef17764073ba2_ppc64le, openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:53da51f3aae7f380b7a76fc074c1fa1f4c81ee627a7cb469713ef17764073ba2_ppc64le |
| Red Hat | openshift-serverless-1/serverless-rhel8-operator@sha256:e24cb22645d0b9dd670d600e4e1aab78e6586c9204a4d72cbb99f6842cdf2fd8_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | *, *, * |
| Red Hat | openshift-serverless-1/eventing-kafka-broker-webhook-rhel8@sha256:379a38af6c07e9bd2d46cacdbe5d3e5f9aad0a2d6a21f0ce76d0185233299211_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/eventing-kafka-broker-webhook-rhel8@sha256:379a38af6c07e9bd2d46cacdbe5d3e5f9aad0a2d6a21f0ce76d0185233299211_ppc64le, *, openshift-serverless-1/eventing-kafka-broker-webhook-rhel8@sha256:379a38af6c07e9bd2d46cacdbe5d3e5f9aad0a2d6a21f0ce76d0185233299211_ppc64le |
| Red Hat | openshift-serverless-1/serving-webhook-rhel8@sha256:65069229bd8647d34971d1ba57d8042c562170ac9806c3957e00fcb66803b534_s390x as a component of Red Hat OpenShift Serverless 1.27 | *, openshift-serverless-1/serving-webhook-rhel8@sha256:65069229bd8647d34971d1ba57d8042c562170ac9806c3957e00fcb66803b534_s390x, openshift-serverless-1/serving-webhook-rhel8@sha256:65069229bd8647d34971d1ba57d8042c562170ac9806c3957e00fcb66803b534_s390x |
| Red Hat | openshift-serverless-1/serving-storage-version-migration-rhel8@sha256:02cc9021895e2de82011e9d8c44699f1b227c85bce52ea4e5e7c8560079763c7_amd64 as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/serving-storage-version-migration-rhel8@sha256:02cc9021895e2de82011e9d8c44699f1b227c85bce52ea4e5e7c8560079763c7_amd64, *, * |
| Red Hat | openshift-serverless-1/eventing-mtbroker-filter-rhel8@sha256:1b4eb85fc221bd51d32889c23cdb05d8855a7e02f4919eb895cec25d44fd1b48_s390x as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/eventing-mtbroker-filter-rhel8@sha256:1b4eb85fc221bd51d32889c23cdb05d8855a7e02f4919eb895cec25d44fd1b48_s390x, *, openshift-serverless-1/eventing-mtbroker-filter-rhel8@sha256:1b4eb85fc221bd51d32889c23cdb05d8855a7e02f4919eb895cec25d44fd1b48_s390x |
| Red Hat | openshift-serverless-1/eventing-controller-rhel8@sha256:fc4105db88a098f5fdca01535e59b630fe35c11ed3789b67cf3c3bcd4dc631f8_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/eventing-controller-rhel8@sha256:fc4105db88a098f5fdca01535e59b630fe35c11ed3789b67cf3c3bcd4dc631f8_ppc64le, *, * |
| Red Hat | openshift-serverless-1/knative-rhel8-operator@sha256:248b380cae9269a2143bfd70615c73ea85b2c7363c092e19e6acf2d91744bc08_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/knative-rhel8-operator@sha256:248b380cae9269a2143bfd70615c73ea85b2c7363c092e19e6acf2d91744bc08_ppc64le, openshift-serverless-1/knative-rhel8-operator@sha256:248b380cae9269a2143bfd70615c73ea85b2c7363c092e19e6acf2d91744bc08_ppc64le, * |
| Red Hat | openshift-serverless-1/serving-controller-rhel8@sha256:87444fd8cdc0aec69e7a16f3c1f9f9598116fadd75b0ee44bcb85210942d492a_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | *, *, openshift-serverless-1/serving-controller-rhel8@sha256:87444fd8cdc0aec69e7a16f3c1f9f9598116fadd75b0ee44bcb85210942d492a_ppc64le |
| Red Hat | openshift-serverless-1/serving-domain-mapping-rhel8@sha256:a7628d34b3a1fba4d964ba89cf242354edfb4f15bfdddbd36fe260d87646a4b6_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/serving-domain-mapping-rhel8@sha256:a7628d34b3a1fba4d964ba89cf242354edfb4f15bfdddbd36fe260d87646a4b6_ppc64le, openshift-serverless-1/serving-domain-mapping-rhel8@sha256:a7628d34b3a1fba4d964ba89cf242354edfb4f15bfdddbd36fe260d87646a4b6_ppc64le, * |
| Red Hat | openshift-serverless-1/net-istio-webhook-rhel8@sha256:c1b866fc57c91d615eed17cb3377a937a72f742e83ae067a8c1d69132aaa4ee1_amd64 as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/net-istio-webhook-rhel8@sha256:c1b866fc57c91d615eed17cb3377a937a72f742e83ae067a8c1d69132aaa4ee1_amd64, *, * |
| Red Hat | openshift-serverless-1/eventing-mtping-rhel8@sha256:bee98500c24775c70aa3d33f2f7ff671b362723c6723cd762cc44cacd216dce9_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | *, openshift-serverless-1/eventing-mtping-rhel8@sha256:bee98500c24775c70aa3d33f2f7ff671b362723c6723cd762cc44cacd216dce9_ppc64le, * |
| Red Hat | openshift-serverless-1/eventing-storage-version-migration-rhel8@sha256:9cabc5856ae4e07a47df3770a4cfdf785cab0b9e311b23dd8ea353db7209fcd9_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | *, openshift-serverless-1/eventing-storage-version-migration-rhel8@sha256:9cabc5856ae4e07a47df3770a4cfdf785cab0b9e311b23dd8ea353db7209fcd9_ppc64le, * |
| Red Hat | openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:39be49f6bc90f995a276b5c4e90ee74421a7523e670e3a9f2a9a02e246a41629_s390x as a component of Red Hat OpenShift Serverless 1.27 | *, *, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:39be49f6bc90f995a276b5c4e90ee74421a7523e670e3a9f2a9a02e246a41629_s390x |
| Red Hat | openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:366b0a392505019b00ec2a7fe08483a7b9562396b2d3c82761d5e207f893088e_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:366b0a392505019b00ec2a7fe08483a7b9562396b2d3c82761d5e207f893088e_ppc64le, *, openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:366b0a392505019b00ec2a7fe08483a7b9562396b2d3c82761d5e207f893088e_ppc64le |
| Red Hat | openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8@sha256:37b9ea2bb66eea728d280de5813a68ffc13b9852e589b96533326c5254780186_s390x as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8@sha256:37b9ea2bb66eea728d280de5813a68ffc13b9852e589b96533326c5254780186_s390x, *, openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8@sha256:37b9ea2bb66eea728d280de5813a68ffc13b9852e589b96533326c5254780186_s390x |
| Red Hat | openshift-serverless-1/eventing-kafka-broker-receiver-rhel8@sha256:72449c3e286fea2f63ec2d2ed3be583d1da8acedf44c6faae9fbed7c3ddb2eca_s390x as a component of Red Hat OpenShift Serverless 1.27 | *, openshift-serverless-1/eventing-kafka-broker-receiver-rhel8@sha256:72449c3e286fea2f63ec2d2ed3be583d1da8acedf44c6faae9fbed7c3ddb2eca_s390x, openshift-serverless-1/eventing-kafka-broker-receiver-rhel8@sha256:72449c3e286fea2f63ec2d2ed3be583d1da8acedf44c6faae9fbed7c3ddb2eca_s390x |
| Red Hat | openshift-serverless-1/ingress-rhel8-operator@sha256:2d8a2bc15553f5936c35acc9a644da5307ee0e35791502dbd59d4ff1e8fef3b7_s390x as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/ingress-rhel8-operator@sha256:2d8a2bc15553f5936c35acc9a644da5307ee0e35791502dbd59d4ff1e8fef3b7_s390x, openshift-serverless-1/ingress-rhel8-operator@sha256:2d8a2bc15553f5936c35acc9a644da5307ee0e35791502dbd59d4ff1e8fef3b7_s390x, * |
| Red Hat | openshift-serverless-1/serving-webhook-rhel8@sha256:3e690975f2bfcd212b1fbc0efd6755c5241baf75e078fa5cb8a6e4c2200e35a6_amd64 as a component of Red Hat OpenShift Serverless 1.27 | *, *, openshift-serverless-1/serving-webhook-rhel8@sha256:3e690975f2bfcd212b1fbc0efd6755c5241baf75e078fa5cb8a6e4c2200e35a6_amd64 |
…and 90 more
Timeline
- Feb 9, 2023 CVE Published
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 9, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:0709 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html/serverless/index advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.12/html/serverless/index advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2124669 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2132867 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2132868 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2132872 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2154755 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2154757 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0709.json advisory
- https://access.redhat.com/security/cve/CVE-2022-2879 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-2879 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-2879 advisory
- https://github.com/golang/go/issues/54853 advisory
- https://github.com/vbatts/tar-split/releases/tag/v0.12.1 advisory
- https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1 advisory
…and 13 more