Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU56829
Risk: Medium
CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-29923
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input in net.ParseIP and net.ParseCIDR, as the Go interpreter does not properly consider extraneous zero characters at the beginning
of an IP address octet. A remote attacker can
bypass access control that is based on IP addresses, because of
unexpected octal interpretation.
Install updates from vendor's website.
openshift-clients (Red Hat package): 4.3.1-202001310552.git.1.075d46a.el7 - 4.9.0-202109101042.p0.git.96e95ce.assembly.stream.el8
Red Hat OpenShift Container Platform: 4.9.0 - 4.9.21
openshift (Red Hat package): 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8 - 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8
jenkins-2-plugins (Red Hat package): 4.9.1630555871-1.el8 - 4.9.1643389956-1.el8
openshift-ansible (Red Hat package): 3.2.42-1.git.0.6b09be9.el7 - 4.8.0-202109241839.p0.git.4bb45f8.assembly.stream.el7
cri-o (Red Hat package): 1.22.1-4.rhaos4.9.gite3dfe61.el7 - 1.22.1-4.rhaos4.9.gite3dfe61.el8
ignition (Red Hat package): 2.12.0-1.rhaos4.9.el8
cri-tools (Red Hat package): 1.22.0-1.el8
butane (Red Hat package): 0.13.1-1.rhaos4.9.el8
golang-github-prometheus-promu (Red Hat package): 0.5.0-3.git642a960.el8 - 0.5.0-4.git642a960.el8
ovn21.12 (Red Hat package): before 21.12.0-25.el8fdp
External linkshttp://access.redhat.com/errata/RHSA-2022:0557
http://access.redhat.com/errata/RHSA-2022:0561
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55668
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-36221
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a race condition in net/http/httputil ReverseProxy when handling ErrAbortHandler events. A remote attacker can trigger a race condition and crash the ReverseProxy.
MitigationInstall updates from vendor's website.
openshift-clients (Red Hat package): 4.3.1-202001310552.git.1.075d46a.el7 - 4.9.0-202109101042.p0.git.96e95ce.assembly.stream.el8
Red Hat OpenShift Container Platform: 4.9.0 - 4.9.21
openshift (Red Hat package): 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8 - 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8
jenkins-2-plugins (Red Hat package): 4.9.1630555871-1.el8 - 4.9.1643389956-1.el8
openshift-ansible (Red Hat package): 3.2.42-1.git.0.6b09be9.el7 - 4.8.0-202109241839.p0.git.4bb45f8.assembly.stream.el7
cri-o (Red Hat package): 1.22.1-4.rhaos4.9.gite3dfe61.el7 - 1.22.1-4.rhaos4.9.gite3dfe61.el8
ignition (Red Hat package): 2.12.0-1.rhaos4.9.el8
cri-tools (Red Hat package): 1.22.0-1.el8
butane (Red Hat package): 0.13.1-1.rhaos4.9.el8
golang-github-prometheus-promu (Red Hat package): 0.5.0-3.git642a960.el8 - 0.5.0-4.git642a960.el8
ovn21.12 (Red Hat package): before 21.12.0-25.el8fdp
External linkshttp://access.redhat.com/errata/RHSA-2022:0557
http://access.redhat.com/errata/RHSA-2022:0561
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.