ID

VAR-202202-0114


CVE

CVE-2022-25236


TITLE

Red Hat Security Advisory 2022-1396-01

Trust: 0.1

sources: PACKETSTORM: 166789

DESCRIPTION

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. Expat is a fast streaming XML parser written in C. There is a security vulnerability before Expat2.4.5, which can be exploited by an attacker to insert a namespace separator into a namespace URI. Summary: The Migration Toolkit for Containers (MTC) 1.5.4 is now available. Description: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Bugs fixed (https://bugzilla.redhat.com/): 1995656 - CVE-2021-36221 golang: net/http/httputil: panic due to racy read of persistConn after handler panic 5. Description: Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications. Security Fix(es): * Openshift-Gitops: Improper access control allows admin privilege escalation (CVE-2022-1025) * argocd: path traversal and improper access control allows leaking out-of-bound files (CVE-2022-24730) * argocd: path traversal allows leaking out-of-bound files (CVE-2022-24731) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bugs fixed (https://bugzilla.redhat.com/): 2062751 - CVE-2022-24730 argocd: path traversal and improper access control allows leaking out-of-bound files 2062755 - CVE-2022-24731 argocd: path traversal allows leaking out-of-bound files 2064682 - CVE-2022-1025 Openshift-Gitops: Improper access control allows admin privilege escalation 5. This update provides security fixes, bug fixes, and updates the container images. Description: Red Hat Advanced Cluster Management for Kubernetes 2.4.3 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide some security fixes and bug fixes. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/ Security updates: * golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565) * nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account (CVE-2022-24450) * nanoid: Information disclosure via valueOf() function (CVE-2021-23566) * nodejs-shelljs: improper privilege management (CVE-2022-0144) * search-ui-container: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor (CVE-2022-0155) * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235) * follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536) * openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778) * imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path (CVE-2022-24778) * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191) * opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190) Related bugs: * RHACM 2.4.3 image files (BZ #2057249) * Observability - dashboard name contains `/` would cause error when generating dashboard cm (BZ #2032128) * ACM application placement fails after renaming the application name (BZ #2033051) * Disable the obs metric collect should not impact the managed cluster upgrade (BZ #2039197) * Observability - cluster list should only contain OCP311 cluster on OCP311 dashboard (BZ #2039820) * The value of name label changed from clusterclaim name to cluster name (BZ #2042223) * VMWare Cluster creation does not accept ecdsa-sha2-nistp521 ssh keys (BZ #2048500) * clusterSelector matchLabels spec are cleared when changing app name/namespace during creating an app in UI (BZ #2053211) * Application cluster status is not updated in UI after restoring (BZ #2053279) * OpenStack cluster creation is using deprecated floating IP config for 4.7+ (BZ #2056610) * The value of Vendor reported by cluster metrics was Other even if the vendor label in managedcluster was Openshift (BZ #2059039) * Subscriptions stop reconciling after channel secrets are recreated (BZ #2059954) * Placementrule is not reconciling on a new fresh environment (BZ #2074156) * The cluster claimed from clusterpool cannot auto imported (BZ #2074543) 3. Bugs fixed (https://bugzilla.redhat.com/): 2024938 - CVE-2021-41190 opencontainers: OCI manifest and index parsing confusion 2030787 - CVE-2021-43565 golang.org/x/crypto: empty plaintext packet causes panic 2032128 - Observability - dashboard name contains `/` would cause error when generating dashboard cm 2033051 - ACM application placement fails after renaming the application name 2039197 - disable the obs metric collect should not impact the managed cluster upgrade 2039820 - Observability - cluster list should only contain OCP311 cluster on OCP311 dashboard 2042223 - the value of name label changed from clusterclaim name to cluster name 2043535 - CVE-2022-0144 nodejs-shelljs: improper privilege management 2044556 - CVE-2022-0155 follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor 2044591 - CVE-2022-0235 node-fetch: exposure of sensitive information to an unauthorized actor 2048500 - VMWare Cluster creation does not accept ecdsa-sha2-nistp521 ssh keys 2050853 - CVE-2021-23566 nanoid: Information disclosure via valueOf() function 2052573 - CVE-2022-24450 nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account 2053211 - clusterSelector matchLabels spec are cleared when changing app name/namespace during creating an app in UI 2053259 - CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak 2053279 - Application cluster status is not updated in UI after restoring 2056610 - OpenStack cluster creation is using deprecated floating IP config for 4.7+ 2057249 - RHACM 2.4.3 images 2059039 - The value of Vendor reported by cluster metrics was Other even if the vendor label in managedcluster was Openshift 2059954 - Subscriptions stop reconciling after channel secrets are recreated 2062202 - CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates 2064702 - CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server 2069368 - CVE-2022-24778 imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path 2074156 - Placementrule is not reconciling on a new fresh environment 2074543 - The cluster claimed from clusterpool can not auto imported 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: thunderbird security update Advisory ID: RHSA-2022:0850-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:0850 Issue date: 2022-03-14 CVE Names: CVE-2022-0566 CVE-2022-25235 CVE-2022-25236 CVE-2022-25315 CVE-2022-26381 CVE-2022-26383 CVE-2022-26384 CVE-2022-26386 CVE-2022-26387 CVE-2022-26485 CVE-2022-26486 ===================================================================== 1. Summary: An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.7.0. Security Fix(es): * Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485) * Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486) * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235) * expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236) * expat: Integer overflow in storeRawNames() (CVE-2022-25315) * Mozilla: Use-after-free in text reflows (CVE-2022-26381) * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383) * Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384) * Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387) * thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566) * Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2055591 - CVE-2022-0566 thunderbird: Crafted email could trigger an out-of-bounds write 2056363 - CVE-2022-25315 expat: Integer overflow in storeRawNames() 2056366 - CVE-2022-25235 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution 2056370 - CVE-2022-25236 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution 2061735 - CVE-2022-26486 Mozilla: Use-after-free in WebGPU IPC Framework 2061736 - CVE-2022-26485 Mozilla: Use-after-free in XSLT parameter processing 2062220 - CVE-2022-26383 Mozilla: Browser window spoof using fullscreen mode 2062221 - CVE-2022-26384 Mozilla: iframe allow-scripts sandbox bypass 2062222 - CVE-2022-26387 Mozilla: Time-of-check time-of-use bug when verifying add-on signatures 2062223 - CVE-2022-26381 Mozilla: Use-after-free in text reflows 2062224 - CVE-2022-26386 Mozilla: Temporary files downloaded to /tmp and accessible by other local users 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: thunderbird-91.7.0-2.el7_9.src.rpm x86_64: thunderbird-91.7.0-2.el7_9.x86_64.rpm thunderbird-debuginfo-91.7.0-2.el7_9.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): Source: thunderbird-91.7.0-2.el7_9.src.rpm ppc64le: thunderbird-91.7.0-2.el7_9.ppc64le.rpm thunderbird-debuginfo-91.7.0-2.el7_9.ppc64le.rpm x86_64: thunderbird-91.7.0-2.el7_9.x86_64.rpm thunderbird-debuginfo-91.7.0-2.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: thunderbird-91.7.0-2.el7_9.src.rpm x86_64: thunderbird-91.7.0-2.el7_9.x86_64.rpm thunderbird-debuginfo-91.7.0-2.el7_9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-0566 https://access.redhat.com/security/cve/CVE-2022-25235 https://access.redhat.com/security/cve/CVE-2022-25236 https://access.redhat.com/security/cve/CVE-2022-25315 https://access.redhat.com/security/cve/CVE-2022-26381 https://access.redhat.com/security/cve/CVE-2022-26383 https://access.redhat.com/security/cve/CVE-2022-26384 https://access.redhat.com/security/cve/CVE-2022-26386 https://access.redhat.com/security/cve/CVE-2022-26387 https://access.redhat.com/security/cve/CVE-2022-26485 https://access.redhat.com/security/cve/CVE-2022-26486 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYi9as9zjgjWX9erEAQi0VA/8DmqELriNmt2kTcKBgMz/PkowFKQVVLE9 Z4xLkVnFBjSYiHsyXBwFlNBJPK1ywvizchEFsj3hkv7+05xJTGLjrvyEaGquYv36 ol+Yrq5hzVATmfC9AivXQLew4+10cqBX5Hl/KoxIsLmn1k+7K0OV5PUo41WaYIYn znNLekFIYpWBe6HmqEs7eErS9TGR6t91o/4iUd2p4LgxEMmJhcZ32clA0k2sWQoC t96wqwaFdYo7SWekWEIsjLu9TjXCZ2QITzxA1gQG0ZymWuaOhpSCoaeu7O3KGy9E j9D5UhAGmWxSWiSMJ2+AP4E4t4CXJ5poE9+T3hgsevt9Lr24Cr9QK77w6/gxpLpj /zuR86oImk/FcnTBE+EY5TNgpPusbMQXZHD0OfmxRqO3TZn8n0mURRBgxkJJPpkb AJX93daJu2FQyRQBRi/WQKbBpi8VKZpmdVIP8i/ZujiKWDzYuwnij4o0/JOTnH5P agTu9G32WnAemVXUK6IlNZamM6IODof4uY7L1A1AtQkpDSzIQ5PpHbxEgtp0NqDO tTBogkwaB3Mkvme2fZ6wu2ALaaJuhnDrA332gITVz9tQ6TJL/M3Z1f0X4007yTSH uPebIvMc7O15OJL1AI7U29MitAXTDqkWoSP8ECMli7w1Ro3cBr/VNQicmkZZyJ3h A8Mb2SG3B+I= =7pc/ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . 8.2) - aarch64, ppc64le, x86_64 3. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202209-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Expat: Multiple Vulnerabilities Date: September 29, 2022 Bugs: #791703, #830422, #831918, #833431, #870097 ID: 202209-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been discovered in Expat, the worst of which could result in arbitrary code execution. Background ========= Expat is a set of XML parsing libraries. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/expat < 2.4.9 >= 2.4.9 Description ========== Multiple vulnerabilities have been discovered in Expat. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All Expat users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">\xdev-libs/expat-2.4.9" References ========= [ 1 ] CVE-2021-45960 https://nvd.nist.gov/vuln/detail/CVE-2021-45960 [ 2 ] CVE-2021-46143 https://nvd.nist.gov/vuln/detail/CVE-2021-46143 [ 3 ] CVE-2022-22822 https://nvd.nist.gov/vuln/detail/CVE-2022-22822 [ 4 ] CVE-2022-22823 https://nvd.nist.gov/vuln/detail/CVE-2022-22823 [ 5 ] CVE-2022-22824 https://nvd.nist.gov/vuln/detail/CVE-2022-22824 [ 6 ] CVE-2022-22825 https://nvd.nist.gov/vuln/detail/CVE-2022-22825 [ 7 ] CVE-2022-22826 https://nvd.nist.gov/vuln/detail/CVE-2022-22826 [ 8 ] CVE-2022-22827 https://nvd.nist.gov/vuln/detail/CVE-2022-22827 [ 9 ] CVE-2022-23852 https://nvd.nist.gov/vuln/detail/CVE-2022-23852 [ 10 ] CVE-2022-23990 https://nvd.nist.gov/vuln/detail/CVE-2022-23990 [ 11 ] CVE-2022-25235 https://nvd.nist.gov/vuln/detail/CVE-2022-25235 [ 12 ] CVE-2022-25236 https://nvd.nist.gov/vuln/detail/CVE-2022-25236 [ 13 ] CVE-2022-25313 https://nvd.nist.gov/vuln/detail/CVE-2022-25313 [ 14 ] CVE-2022-25314 https://nvd.nist.gov/vuln/detail/CVE-2022-25314 [ 15 ] CVE-2022-25315 https://nvd.nist.gov/vuln/detail/CVE-2022-25315 [ 16 ] CVE-2022-40674 https://nvd.nist.gov/vuln/detail/CVE-2022-40674 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202209-24 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2022 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.51 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Service Pack 10, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. After installing the updated packages, the httpd daemon will be restarted automatically

Trust: 1.8

sources: NVD: CVE-2022-25236 // VULHUB: VHN-415127 // PACKETSTORM: 166789 // PACKETSTORM: 166433 // PACKETSTORM: 166437 // PACKETSTORM: 166812 // PACKETSTORM: 166293 // PACKETSTORM: 166300 // PACKETSTORM: 168578 // PACKETSTORM: 169540 // PACKETSTORM: 169541

AFFECTED PRODUCTS

vendor:oraclemodel:http serverscope:eqversion:12.2.1.4.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:oraclemodel:zfs storage appliance kitscope:eqversion:8.8

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:11.0

Trust: 1.0

vendor:oraclemodel:http serverscope:eqversion:12.2.1.3.0

Trust: 1.0

vendor:siemensmodel:sinema remote connect serverscope:ltversion:3.1

Trust: 1.0

vendor:libexpatmodel:libexpatscope:ltversion:2.4.5

Trust: 1.0

sources: NVD: CVE-2022-25236

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-25236
value: CRITICAL

Trust: 1.0

VULHUB: VHN-415127
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2022-25236
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-415127
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-25236
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-415127 // NVD: CVE-2022-25236

PROBLEMTYPE DATA

problemtype:CWE-668

Trust: 1.1

sources: VULHUB: VHN-415127 // NVD: CVE-2022-25236

TYPE

overflow, code execution

Trust: 0.4

sources: PACKETSTORM: 166293 // PACKETSTORM: 166300 // PACKETSTORM: 169540 // PACKETSTORM: 169541

EXTERNAL IDS

db:NVDid:CVE-2022-25236

Trust: 2.0

db:PACKETSTORMid:167238

Trust: 1.1

db:SIEMENSid:SSA-484086

Trust: 1.1

db:OPENWALLid:OSS-SECURITY/2022/02/19/1

Trust: 1.1

db:PACKETSTORMid:166293

Trust: 0.2

db:PACKETSTORMid:166433

Trust: 0.2

db:PACKETSTORMid:166437

Trust: 0.2

db:PACKETSTORMid:168578

Trust: 0.2

db:PACKETSTORMid:166300

Trust: 0.2

db:PACKETSTORMid:166277

Trust: 0.1

db:PACKETSTORMid:167226

Trust: 0.1

db:PACKETSTORMid:166276

Trust: 0.1

db:PACKETSTORMid:166505

Trust: 0.1

db:PACKETSTORMid:166500

Trust: 0.1

db:PACKETSTORMid:166296

Trust: 0.1

db:PACKETSTORMid:166453

Trust: 0.1

db:PACKETSTORMid:166496

Trust: 0.1

db:PACKETSTORMid:166983

Trust: 0.1

db:PACKETSTORMid:166254

Trust: 0.1

db:PACKETSTORMid:166954

Trust: 0.1

db:PACKETSTORMid:166298

Trust: 0.1

db:PACKETSTORMid:166348

Trust: 0.1

db:PACKETSTORMid:166261

Trust: 0.1

db:PACKETSTORMid:166275

Trust: 0.1

db:PACKETSTORMid:169777

Trust: 0.1

db:PACKETSTORMid:166291

Trust: 0.1

db:PACKETSTORMid:166414

Trust: 0.1

db:PACKETSTORMid:166274

Trust: 0.1

db:CNVDid:CNVD-2022-18357

Trust: 0.1

db:VULHUBid:VHN-415127

Trust: 0.1

db:PACKETSTORMid:166789

Trust: 0.1

db:PACKETSTORMid:166812

Trust: 0.1

db:PACKETSTORMid:169540

Trust: 0.1

db:PACKETSTORMid:169541

Trust: 0.1

sources: VULHUB: VHN-415127 // PACKETSTORM: 166789 // PACKETSTORM: 166433 // PACKETSTORM: 166437 // PACKETSTORM: 166812 // PACKETSTORM: 166293 // PACKETSTORM: 166300 // PACKETSTORM: 168578 // PACKETSTORM: 169540 // PACKETSTORM: 169541 // NVD: CVE-2022-25236

REFERENCES

url:https://security.gentoo.org/glsa/202209-24

Trust: 1.2

url:https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf

Trust: 1.1

url:https://security.netapp.com/advisory/ntap-20220303-0008/

Trust: 1.1

url:https://www.debian.org/security/2022/dsa-5085

Trust: 1.1

url:http://packetstormsecurity.com/files/167238/zoom-xmpp-stanza-smuggling-remote-code-execution.html

Trust: 1.1

url:https://github.com/libexpat/libexpat/pull/561

Trust: 1.1

url:https://www.oracle.com/security-alerts/cpuapr2022.html

Trust: 1.1

url:https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html

Trust: 1.1

url:http://www.openwall.com/lists/oss-security/2022/02/19/1

Trust: 1.1

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ufrba3uqviqkxtbuqxdwqovwnbkleru/

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/y27xo3jmkaomqzvps3b4mjgeahczf5om/

Trust: 1.0

url:https://access.redhat.com/security/cve/cve-2022-25315

Trust: 0.8

url:https://access.redhat.com/security/cve/cve-2022-25236

Trust: 0.8

url:https://access.redhat.com/security/cve/cve-2022-25235

Trust: 0.8

url:https://bugzilla.redhat.com/):

Trust: 0.8

url:https://access.redhat.com/security/team/contact/

Trust: 0.8

url:https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.8

url:https://access.redhat.com/security/cve/cve-2022-23852

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2022-22822

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2022-22823

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2022-22827

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2022-22826

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2022-22824

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2021-45960

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2022-22825

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2021-46143

Trust: 0.6

url:https://access.redhat.com/articles/11258

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-45960

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2022-22822

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-46143

Trust: 0.6

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2022-22825

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-22823

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-22826

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-22824

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-25236

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-22827

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-25235

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-23852

Trust: 0.5

url:https://access.redhat.com/security/cve/cve-2022-23308

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2021-31566

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-23177

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2021-3999

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-23219

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-23218

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2021-23177

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-31566

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-25315

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-0392

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-0261

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-0413

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-24407

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-0361

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-0359

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-0318

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-3999

Trust: 0.3

url:https://access.redhat.com/security/team/key/

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-25710

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0492

Trust: 0.2

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-4154

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-25710

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-41190

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-0920

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-25709

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0847

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0435

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-22942

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0330

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0516

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0778

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-0920

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-25709

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-1025

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-23219

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0361

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0261

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-24407

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0318

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-24731

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-23218

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-24730

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-23308

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0413

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-24731

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-24730

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0359

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0392

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-1025

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-26485

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-26386

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0566

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-26387

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-26386

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-26383

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-26486

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-26387

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-26381

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-26384

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-26383

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-26485

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-26486

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-26384

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0566

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-26381

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-33193

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-44224

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-25313

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-36160

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-39275

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-41524

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-33193

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-41524

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-23990

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-25314

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-44224

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-36160

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-39275

Trust: 0.2

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ufrba3uqviqkxtbuqxdwqovwnbkleru/

Trust: 0.1

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/y27xo3jmkaomqzvps3b4mjgeahczf5om/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22925

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-19603

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-20838

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-21684

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-12762

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-36085

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-16135

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-36084

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-20231

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-20232

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-28153

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3445

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-36086

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-4122

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-17594

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-36087

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22898

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-42574

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-5827

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-19603

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-18218

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-14155

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-13435

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-33560

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-16135

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-14155

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-17595

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-13751

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3426

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-22817

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3572

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-20232

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-20838

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-22925

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-44716

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1396

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-17594

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-22876

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-13750

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-12762

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-3577

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-13435

Trust: 0.1

url:https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-36221

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-28153

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-18218

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0532

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22876

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2014-3577

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-22898

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-22816

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3580

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3800

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-21684

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-13751

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-17595

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3200

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-24370

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-20231

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-24370

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-5827

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-13750

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3521

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-44717

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1041

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1039

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0536

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0235

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0330

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0516

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-41190

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/index

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0778

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0811

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-27191

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0847

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0155

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-23566

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0155

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html-single/install/index#installing

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0435

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-4154

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1476

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-24778

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0144

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-23566

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0235

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-24450

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-43565

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0811

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-43565

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0536

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0144

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0492

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0850

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0843

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:https://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-40674

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-25314

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-23990

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-25313

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:7144

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:7143

Trust: 0.1

sources: VULHUB: VHN-415127 // PACKETSTORM: 166789 // PACKETSTORM: 166433 // PACKETSTORM: 166437 // PACKETSTORM: 166812 // PACKETSTORM: 166293 // PACKETSTORM: 166300 // PACKETSTORM: 168578 // PACKETSTORM: 169540 // PACKETSTORM: 169541 // NVD: CVE-2022-25236

CREDITS

Red Hat

Trust: 0.8

sources: PACKETSTORM: 166789 // PACKETSTORM: 166433 // PACKETSTORM: 166437 // PACKETSTORM: 166812 // PACKETSTORM: 166293 // PACKETSTORM: 166300 // PACKETSTORM: 169540 // PACKETSTORM: 169541

SOURCES

db:VULHUBid:VHN-415127
db:PACKETSTORMid:166789
db:PACKETSTORMid:166433
db:PACKETSTORMid:166437
db:PACKETSTORMid:166812
db:PACKETSTORMid:166293
db:PACKETSTORMid:166300
db:PACKETSTORMid:168578
db:PACKETSTORMid:169540
db:PACKETSTORMid:169541
db:NVDid:CVE-2022-25236

LAST UPDATE DATE

2024-11-20T20:06:12.760000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-415127date:2022-10-07T00:00:00
db:NVDid:CVE-2022-25236date:2023-11-07T03:44:45.010

SOURCES RELEASE DATE

db:VULHUBid:VHN-415127date:2022-02-16T00:00:00
db:PACKETSTORMid:166789date:2022-04-20T15:12:33
db:PACKETSTORMid:166433date:2022-03-24T14:36:50
db:PACKETSTORMid:166437date:2022-03-24T14:40:17
db:PACKETSTORMid:166812date:2022-04-21T15:12:25
db:PACKETSTORMid:166293date:2022-03-14T18:48:38
db:PACKETSTORMid:166300date:2022-03-14T18:55:46
db:PACKETSTORMid:168578date:2022-09-30T14:56:43
db:PACKETSTORMid:169540date:2022-10-27T13:05:19
db:PACKETSTORMid:169541date:2022-10-27T13:05:26
db:NVDid:CVE-2022-25236date:2022-02-16T01:15:07.650