ID

VAR-202202-0906


CVE

CVE-2022-23308


TITLE

libxml2 Resource Management Error Vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202202-1722

DESCRIPTION

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. For more information, see the documentation linked in the Solution section. Bugs fixed (https://bugzilla.redhat.com/): 2020725 - CVE-2021-41771 golang: debug/macho: invalid dynamic symbol table command can cause panic 2020736 - CVE-2021-41772 golang: archive/zip: Reader.Open panics on empty string 5. References: https://access.redhat.com/security/cve/CVE-2018-25032 https://access.redhat.com/security/cve/CVE-2021-3999 https://access.redhat.com/security/cve/CVE-2021-23177 https://access.redhat.com/security/cve/CVE-2021-31566 https://access.redhat.com/security/cve/CVE-2021-41771 https://access.redhat.com/security/cve/CVE-2021-41772 https://access.redhat.com/security/cve/CVE-2021-45960 https://access.redhat.com/security/cve/CVE-2021-46143 https://access.redhat.com/security/cve/CVE-2022-0778 https://access.redhat.com/security/cve/CVE-2022-21426 https://access.redhat.com/security/cve/CVE-2022-21434 https://access.redhat.com/security/cve/CVE-2022-21443 https://access.redhat.com/security/cve/CVE-2022-21449 https://access.redhat.com/security/cve/CVE-2022-21476 https://access.redhat.com/security/cve/CVE-2022-21496 https://access.redhat.com/security/cve/CVE-2022-22822 https://access.redhat.com/security/cve/CVE-2022-22823 https://access.redhat.com/security/cve/CVE-2022-22824 https://access.redhat.com/security/cve/CVE-2022-22825 https://access.redhat.com/security/cve/CVE-2022-22826 https://access.redhat.com/security/cve/CVE-2022-22827 https://access.redhat.com/security/cve/CVE-2022-23218 https://access.redhat.com/security/cve/CVE-2022-23219 https://access.redhat.com/security/cve/CVE-2022-23308 https://access.redhat.com/security/cve/CVE-2022-23852 https://access.redhat.com/security/cve/CVE-2022-25235 https://access.redhat.com/security/cve/CVE-2022-25236 https://access.redhat.com/security/cve/CVE-2022-25315 For details about the security issues see these CVE pages: * https://access.redhat.com/security/updates/classification/#low * https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index * https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index * https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index * https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index * https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index 6. Summary: The Migration Toolkit for Containers (MTC) 1.7.1 is now available. Description: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Bugs fixed (https://bugzilla.redhat.com/): 2020725 - CVE-2021-41771 golang: debug/macho: invalid dynamic symbol table command can cause panic 2020736 - CVE-2021-41772 golang: archive/zip: Reader.Open panics on empty string 2024938 - CVE-2021-41190 opencontainers: OCI manifest and index parsing confusion 2030801 - CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache 2030806 - CVE-2021-44717 golang: syscall: don't close fd 0 on ForkExec error 2040378 - Don't allow Storage class conversion migration if source cluster has only one storage class defined [backend] 2057516 - [MTC UI] UI should not allow PVC mapping for Full migration 2060244 - [MTC] DIM registry route need to be exposed to create inter-cluster state migration plans 2060717 - [MTC] Registry pod goes in CrashLoopBackOff several times when MCG Nooba is used as the Replication Repository 2061347 - [MTC] Log reader pod is missing velero and restic pod logs. 2061653 - [MTC UI] Migration Resources section showing pods from other namespaces 2062682 - [MTC] Destination storage class non-availability warning visible in Intra-cluster source to source state-migration migplan. 2065837 - controller_config.yml.j2 merge type should be set to merge (currently using the default strategic) 2071000 - Storage Conversion: UI doesn't have the ability to skip PVC 2072036 - Migration plan for storage conversion cannot be created if there's no replication repository 2072186 - Wrong migration type description 2072684 - Storage Conversion: PersistentVolumeClaimTemplates in StatefulSets are not updated automatically after migration 2073496 - Errors in rsync pod creation are not printed in the controller logs 2079814 - [MTC UI] Intra-cluster state migration plan showing a warning on PersistentVolumes page 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: libxml2 security update Advisory ID: RHSA-2022:0899-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:0899 Issue date: 2022-03-15 CVE Names: CVE-2022-23308 ===================================================================== 1. Summary: An update for libxml2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Use-after-free of ID and IDREF attributes (CVE-2022-23308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The desktop must be restarted (log out, then log back in) for this update to take effect. 5. Package List: Red Hat Enterprise Linux AppStream (v. 8): aarch64: libxml2-debuginfo-2.9.7-12.el8_5.aarch64.rpm libxml2-debugsource-2.9.7-12.el8_5.aarch64.rpm libxml2-devel-2.9.7-12.el8_5.aarch64.rpm python3-libxml2-debuginfo-2.9.7-12.el8_5.aarch64.rpm ppc64le: libxml2-debuginfo-2.9.7-12.el8_5.ppc64le.rpm libxml2-debugsource-2.9.7-12.el8_5.ppc64le.rpm libxml2-devel-2.9.7-12.el8_5.ppc64le.rpm python3-libxml2-debuginfo-2.9.7-12.el8_5.ppc64le.rpm s390x: libxml2-debuginfo-2.9.7-12.el8_5.s390x.rpm libxml2-debugsource-2.9.7-12.el8_5.s390x.rpm libxml2-devel-2.9.7-12.el8_5.s390x.rpm python3-libxml2-debuginfo-2.9.7-12.el8_5.s390x.rpm x86_64: libxml2-debuginfo-2.9.7-12.el8_5.i686.rpm libxml2-debuginfo-2.9.7-12.el8_5.x86_64.rpm libxml2-debugsource-2.9.7-12.el8_5.i686.rpm libxml2-debugsource-2.9.7-12.el8_5.x86_64.rpm libxml2-devel-2.9.7-12.el8_5.i686.rpm libxml2-devel-2.9.7-12.el8_5.x86_64.rpm python3-libxml2-debuginfo-2.9.7-12.el8_5.i686.rpm python3-libxml2-debuginfo-2.9.7-12.el8_5.x86_64.rpm Red Hat Enterprise Linux BaseOS (v. 8): Source: libxml2-2.9.7-12.el8_5.src.rpm aarch64: libxml2-2.9.7-12.el8_5.aarch64.rpm libxml2-debuginfo-2.9.7-12.el8_5.aarch64.rpm libxml2-debugsource-2.9.7-12.el8_5.aarch64.rpm python3-libxml2-2.9.7-12.el8_5.aarch64.rpm python3-libxml2-debuginfo-2.9.7-12.el8_5.aarch64.rpm ppc64le: libxml2-2.9.7-12.el8_5.ppc64le.rpm libxml2-debuginfo-2.9.7-12.el8_5.ppc64le.rpm libxml2-debugsource-2.9.7-12.el8_5.ppc64le.rpm python3-libxml2-2.9.7-12.el8_5.ppc64le.rpm python3-libxml2-debuginfo-2.9.7-12.el8_5.ppc64le.rpm s390x: libxml2-2.9.7-12.el8_5.s390x.rpm libxml2-debuginfo-2.9.7-12.el8_5.s390x.rpm libxml2-debugsource-2.9.7-12.el8_5.s390x.rpm python3-libxml2-2.9.7-12.el8_5.s390x.rpm python3-libxml2-debuginfo-2.9.7-12.el8_5.s390x.rpm x86_64: libxml2-2.9.7-12.el8_5.i686.rpm libxml2-2.9.7-12.el8_5.x86_64.rpm libxml2-debuginfo-2.9.7-12.el8_5.i686.rpm libxml2-debuginfo-2.9.7-12.el8_5.x86_64.rpm libxml2-debugsource-2.9.7-12.el8_5.i686.rpm libxml2-debugsource-2.9.7-12.el8_5.x86_64.rpm python3-libxml2-2.9.7-12.el8_5.x86_64.rpm python3-libxml2-debuginfo-2.9.7-12.el8_5.i686.rpm python3-libxml2-debuginfo-2.9.7-12.el8_5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-23308 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYjCsLtzjgjWX9erEAQgC3A/+JqflBYt7BRDl+8ywG/jVUy0PU8aFI38V 0YzE84FLWjYB+MyvYjpqSg9T6sGl9B4baVZQvaPEpxlR2NNion/a7hNcnkc1nNoA ZJkEI3XkMMhOBGjofye8rNyVXQYKi2HXe0Qp36C2FPmgvS00MCUk54qkoL4Jcehk 7FZ6s+LASlqDzBUKjWElbr1r5XydUETCPBG+PUlXWI5rQpkiYzUAyFTuANGJY48i e+WEYqLbBdwFAMJmOOEUQINd/Qh3bJXl/Z6Ph9OYsFQN3DRzq36YVukXIYXrtn2s DFUsAR/CucnGqdRFoGG8qQEwJDLU0SqNh/mDzjGH+RAZu/RoyFh7axWEpAEUTFMq JLNte4462UGqyrrUmtcBjJbuJc1VEYIH9qVvvf38tRy5uquDYs1Va/tPL7gVnIGs SF3djaXXKZ2sooL8/VY4g77/OC3RT5XQ9zIzjc2q6yATl37M1SBhQ7g/sAxtkuYQ T1mZT/UMY728GdhYJsqGOLNUMYSKFZsbyV1sYuXbD8pHVnNp5pnXWkhJqp5e7WKd VmJUwc6RPSP6dChuKjbgQYJaZ2yPaU0BObC41NuTgIcEtIYaXXt3dKw1fMsiOVEM 5L3yTc8oeqEjcgTnighI9kd2dlJpG9SWnezWtikUGFq6jl68L2KEMQAKNtifYzdz 6KQ/CjAj1i0= =vJSV -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Description: Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications. Bugs fixed (https://bugzilla.redhat.com/): 2062751 - CVE-2022-24730 argocd: path traversal and improper access control allows leaking out-of-bound files 2062755 - CVE-2022-24731 argocd: path traversal allows leaking out-of-bound files 2064682 - CVE-2022-1025 Openshift-Gitops: Improper access control allows admin privilege escalation 5. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release adds the new Apache HTTP Server 2.4.37 Service Pack 11 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Service Pack 10 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Bugs fixed (https://bugzilla.redhat.com/): 1950515 - CVE-2021-3541 libxml2: Exponential entity expansion attack bypasses all existing protection mechanisms 1954225 - CVE-2021-3516 libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c 1954232 - CVE-2021-3517 libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c 1954242 - CVE-2021-3518 libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c 1956522 - CVE-2021-3537 libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode 2056913 - CVE-2022-23308 libxml2: Use-after-free of ID and IDREF attributes 2062202 - CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates 2064321 - CVE-2022-22720 httpd: Errors encountered during the discarding of request body lead to HTTP request smuggling 5. Summary: Red Hat Advanced Cluster Management for Kubernetes 2.3.8 General Availability release images, which provide security and container updates. Description: Red Hat Advanced Cluster Management for Kubernetes 2.3.8 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html/release_notes/ Security updates: * nanoid: Information disclosure via valueOf() function (CVE-2021-23566) * nodejs-shelljs: improper privilege management (CVE-2022-0144) * follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor (CVE-2022-0155) * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235) * follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536) Bug fix: * RHACM 2.3.8 images (Bugzilla #2062316) 3. Bugs fixed (https://bugzilla.redhat.com/): 2043535 - CVE-2022-0144 nodejs-shelljs: improper privilege management 2044556 - CVE-2022-0155 follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor 2044591 - CVE-2022-0235 node-fetch: exposure of sensitive information to an unauthorized actor 2050853 - CVE-2021-23566 nanoid: Information disclosure via valueOf() function 2053259 - CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak 2062316 - RHACM 2.3.8 images 5

Trust: 1.62

sources: NVD: CVE-2022-23308 // VULHUB: VHN-412332 // PACKETSTORM: 167008 // PACKETSTORM: 166976 // PACKETSTORM: 166327 // PACKETSTORM: 166437 // PACKETSTORM: 166805 // PACKETSTORM: 166803 // PACKETSTORM: 166516

AFFECTED PRODUCTS

vendor:netappmodel:h700sscope:eqversion: -

Trust: 1.0

vendor:applemodel:macosscope:gteversion:12.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.15.7

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:10.15.7

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:34

Trust: 1.0

vendor:netappmodel:bootstrap osscope:eqversion: -

Trust: 1.0

vendor:oraclemodel:communications cloud native core network repository functionscope:eqversion:22.1.2

Trust: 1.0

vendor:applemodel:macosscope:gteversion:11.6.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:netappmodel:solidfire \& hci management nodescope:eqversion: -

Trust: 1.0

vendor:netappmodel:clustered data ontapscope:eqversion: -

Trust: 1.0

vendor:xmlsoftmodel:libxml2scope:ltversion:2.9.13

Trust: 1.0

vendor:netappmodel:h300escope:eqversion: -

Trust: 1.0

vendor:netappmodel:snapdrivescope:eqversion: -

Trust: 1.0

vendor:oraclemodel:communications cloud native core network slice selection functionscope:eqversion:22.1.1

Trust: 1.0

vendor:oraclemodel:zfs storage appliance kitscope:eqversion:8.8

Trust: 1.0

vendor:applemodel:macosscope:ltversion:12.4

Trust: 1.0

vendor:netappmodel:h700escope:eqversion: -

Trust: 1.0

vendor:applemodel:mac os xscope:gteversion:10.15.0

Trust: 1.0

vendor:netappmodel:solidfire\, enterprise sds \& hci storage nodescope:eqversion: -

Trust: 1.0

vendor:applemodel:tvosscope:ltversion:15.5

Trust: 1.0

vendor:oraclemodel:mysql workbenchscope:lteversion:8.0.29

Trust: 1.0

vendor:netappmodel:smi-s providerscope:eqversion: -

Trust: 1.0

vendor:oraclemodel:communications cloud native core binding support functionscope:eqversion:22.2.0

Trust: 1.0

vendor:netappmodel:h410cscope:eqversion: -

Trust: 1.0

vendor:oraclemodel:communications cloud native core network repository functionscope:eqversion:22.2.0

Trust: 1.0

vendor:netappmodel:clustered data ontap antivirus connectorscope:eqversion: -

Trust: 1.0

vendor:netappmodel:snapmanagerscope:eqversion: -

Trust: 1.0

vendor:netappmodel:active iq unified managerscope:eqversion: -

Trust: 1.0

vendor:netappmodel:h500escope:eqversion: -

Trust: 1.0

vendor:oraclemodel:communications cloud native core unified data repositoryscope:eqversion:22.2.0

Trust: 1.0

vendor:applemodel:watchosscope:ltversion:8.6

Trust: 1.0

vendor:netappmodel:manageability software development kitscope:eqversion: -

Trust: 1.0

vendor:netappmodel:h300sscope:eqversion: -

Trust: 1.0

vendor:applemodel:ipadosscope:ltversion:15.5

Trust: 1.0

vendor:netappmodel:h500sscope:eqversion: -

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:15.5

Trust: 1.0

vendor:applemodel:macosscope:ltversion:11.6.6

Trust: 1.0

vendor:oraclemodel:communications cloud native core network function cloud native environmentscope:eqversion:22.1.0

Trust: 1.0

vendor:netappmodel:h410sscope:eqversion: -

Trust: 1.0

vendor:netappmodel:ontap select deploy administration utilityscope:eqversion: -

Trust: 1.0

sources: NVD: CVE-2022-23308

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-23308
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202202-1722
value: HIGH

Trust: 0.6

VULHUB: VHN-412332
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2022-23308
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-412332
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-23308
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-412332 // CNNVD: CNNVD-202202-1722 // NVD: CVE-2022-23308

PROBLEMTYPE DATA

problemtype:CWE-416

Trust: 1.1

sources: VULHUB: VHN-412332 // NVD: CVE-2022-23308

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202202-1722

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202202-1722

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-412332

PATCH

title:libxml2 Remediation of resource management error vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=184325

Trust: 0.6

sources: CNNVD: CNNVD-202202-1722

EXTERNAL IDS

db:NVDid:CVE-2022-23308

Trust: 2.4

db:PACKETSTORMid:167008

Trust: 0.8

db:PACKETSTORMid:166437

Trust: 0.8

db:PACKETSTORMid:166327

Trust: 0.8

db:PACKETSTORMid:168719

Trust: 0.7

db:PACKETSTORMid:167194

Trust: 0.7

db:PACKETSTORMid:166304

Trust: 0.7

db:PACKETSTORMid:166803

Trust: 0.7

db:AUSCERTid:ESB-2022.2569

Trust: 0.6

db:AUSCERTid:ESB-2022.1263

Trust: 0.6

db:AUSCERTid:ESB-2023.3732

Trust: 0.6

db:AUSCERTid:ESB-2022.1677

Trust: 0.6

db:AUSCERTid:ESB-2022.0927

Trust: 0.6

db:AUSCERTid:ESB-2022.1051

Trust: 0.6

db:AUSCERTid:ESB-2022.2411

Trust: 0.6

db:AUSCERTid:ESB-2022.4099

Trust: 0.6

db:AUSCERTid:ESB-2022.1073

Trust: 0.6

db:AUSCERTid:ESB-2022.5782

Trust: 0.6

db:AUSCERTid:ESB-2022.3672

Trust: 0.6

db:CS-HELPid:SB2022051708

Trust: 0.6

db:CS-HELPid:SB2022031503

Trust: 0.6

db:CS-HELPid:SB2022051713

Trust: 0.6

db:CS-HELPid:SB2022042138

Trust: 0.6

db:CS-HELPid:SB2022072710

Trust: 0.6

db:CS-HELPid:SB2022072053

Trust: 0.6

db:CS-HELPid:SB2022032843

Trust: 0.6

db:CS-HELPid:SB2022072640

Trust: 0.6

db:CS-HELPid:SB2022041523

Trust: 0.6

db:CS-HELPid:SB2022051839

Trust: 0.6

db:CS-HELPid:SB2022051326

Trust: 0.6

db:CS-HELPid:SB2022030110

Trust: 0.6

db:CS-HELPid:SB2022031620

Trust: 0.6

db:CS-HELPid:SB2022031525

Trust: 0.6

db:CS-HELPid:SB2022032445

Trust: 0.6

db:CS-HELPid:SB2022053128

Trust: 0.6

db:CNNVDid:CNNVD-202202-1722

Trust: 0.6

db:PACKETSTORMid:166431

Trust: 0.1

db:PACKETSTORMid:166433

Trust: 0.1

db:PACKETSTORMid:167188

Trust: 0.1

db:PACKETSTORMid:167185

Trust: 0.1

db:PACKETSTORMid:167189

Trust: 0.1

db:PACKETSTORMid:167184

Trust: 0.1

db:PACKETSTORMid:167193

Trust: 0.1

db:PACKETSTORMid:167186

Trust: 0.1

db:VULHUBid:VHN-412332

Trust: 0.1

db:PACKETSTORMid:166976

Trust: 0.1

db:PACKETSTORMid:166805

Trust: 0.1

db:PACKETSTORMid:166516

Trust: 0.1

sources: VULHUB: VHN-412332 // PACKETSTORM: 167008 // PACKETSTORM: 166976 // PACKETSTORM: 166327 // PACKETSTORM: 166437 // PACKETSTORM: 166805 // PACKETSTORM: 166803 // PACKETSTORM: 166516 // CNNVD: CNNVD-202202-1722 // NVD: CVE-2022-23308

REFERENCES

url:https://github.com/gnome/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e

Trust: 1.7

url:https://security.netapp.com/advisory/ntap-20220331-0008/

Trust: 1.7

url:https://support.apple.com/kb/ht213253

Trust: 1.7

url:https://support.apple.com/kb/ht213254

Trust: 1.7

url:https://support.apple.com/kb/ht213255

Trust: 1.7

url:https://support.apple.com/kb/ht213256

Trust: 1.7

url:https://support.apple.com/kb/ht213257

Trust: 1.7

url:https://support.apple.com/kb/ht213258

Trust: 1.7

url:http://seclists.org/fulldisclosure/2022/may/34

Trust: 1.7

url:http://seclists.org/fulldisclosure/2022/may/38

Trust: 1.7

url:http://seclists.org/fulldisclosure/2022/may/35

Trust: 1.7

url:http://seclists.org/fulldisclosure/2022/may/33

Trust: 1.7

url:http://seclists.org/fulldisclosure/2022/may/36

Trust: 1.7

url:http://seclists.org/fulldisclosure/2022/may/37

Trust: 1.7

url:https://security.gentoo.org/glsa/202210-03

Trust: 1.7

url:https://gitlab.gnome.org/gnome/libxml2/-/blob/v2.9.13/news

Trust: 1.7

url:https://www.oracle.com/security-alerts/cpujul2022.html

Trust: 1.7

url:https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html

Trust: 1.7

url:https://access.redhat.com/security/cve/cve-2022-23308

Trust: 1.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-23308

Trust: 1.1

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/la3mwwayzadwj5f6joubx65uzamqb7rf/

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/la3mwwayzadwj5f6joubx65uzamqb7rf/

Trust: 0.7

url:https://access.redhat.com/security/team/contact/

Trust: 0.7

url:https://bugzilla.redhat.com/):

Trust: 0.7

url:https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.7

url:https://www.cybersecurity-help.cz/vdb/sb2022051713

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.2569

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072710

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022051839

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1051

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1073

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072053

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.4099

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.5782

Trust: 0.6

url:https://packetstormsecurity.com/files/166803/red-hat-security-advisory-2022-1390-01.html

Trust: 0.6

url:https://vigilance.fr/vulnerability/libxml2-five-vulnerabilities-37614

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022032843

Trust: 0.6

url:https://packetstormsecurity.com/files/166304/ubuntu-security-notice-usn-5324-1.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022053128

Trust: 0.6

url:https://packetstormsecurity.com/files/167194/apple-security-advisory-2022-05-16-6.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.2411

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022032445

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022051326

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-23308/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1263

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072640

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022051708

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2023.3732

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022042138

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022041523

Trust: 0.6

url:https://packetstormsecurity.com/files/168719/gentoo-linux-security-advisory-202210-03.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022030110

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0927

Trust: 0.6

url:https://support.apple.com/en-us/ht213254

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.3672

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022031503

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022031525

Trust: 0.6

url:https://packetstormsecurity.com/files/167008/red-hat-security-advisory-2022-1747-01.html

Trust: 0.6

url:https://packetstormsecurity.com/files/166327/red-hat-security-advisory-2022-0899-01.html

Trust: 0.6

url:https://packetstormsecurity.com/files/166437/red-hat-security-advisory-2022-1039-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022031620

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1677

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2021-31566

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22825

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-25236

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-23177

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2021-23177

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-22825

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-22827

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-22823

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2021-3999

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2021-46143

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-23218

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-25235

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-46143

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-3999

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-22824

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22823

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22824

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-45960

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-0778

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-22826

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-22822

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-23852

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-0778

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-23219

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-25315

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-31566

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22822

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2021-45960

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-23218

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22826

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22827

Trust: 0.3

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.3

url:https://access.redhat.com/articles/11258

Trust: 0.3

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-23219

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-25235

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-41772

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-23852

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-41772

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-41771

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-41771

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0361

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0392

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0318

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0261

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0359

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0413

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0359

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0413

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0361

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0261

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0392

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0318

Trust: 0.2

url:https://access.redhat.com/security/team/key/

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-3537

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3541

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-22720

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3516

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-3517

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22720

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3518

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3537

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-3541

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3517

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-3518

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-3516

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-21426

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21443

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21476

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#low

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1747

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21449

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21496

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21496

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21449

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21434

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21443

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-21434

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2018-25032

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-25032

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21426

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21476

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index

Trust: 0.1

url:https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-41190

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-1154

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-44717

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-41190

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-44717

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-44716

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-1154

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-44716

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-25636

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-1271

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-4028

Trust: 0.1

url:https://docs.openshift.com/container-platform/4.10/migration_toolkit_for_containers/mtc-release-notes.html

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1734

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-4028

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-1271

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0899

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-1025

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-25710

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-25709

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-24407

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-24407

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-25710

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-24731

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-25236

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-24730

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-25315

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-25709

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-24731

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-24730

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1039

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-1025

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1389

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1390

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0235

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0330

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0155

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0235

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0516

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0536

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html-single/install/index#installing

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html/release_notes/index

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0492

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0536

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1083

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-0920

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0144

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0847

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-23566

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-0920

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0435

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0435

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0847

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0330

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html/release_notes/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-4154

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0144

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0516

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-22942

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-4154

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-23566

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0155

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0492

Trust: 0.1

sources: VULHUB: VHN-412332 // PACKETSTORM: 167008 // PACKETSTORM: 166976 // PACKETSTORM: 166327 // PACKETSTORM: 166437 // PACKETSTORM: 166805 // PACKETSTORM: 166803 // PACKETSTORM: 166516 // CNNVD: CNNVD-202202-1722 // NVD: CVE-2022-23308

CREDITS

Red Hat

Trust: 0.7

sources: PACKETSTORM: 167008 // PACKETSTORM: 166976 // PACKETSTORM: 166327 // PACKETSTORM: 166437 // PACKETSTORM: 166805 // PACKETSTORM: 166803 // PACKETSTORM: 166516

SOURCES

db:VULHUBid:VHN-412332
db:PACKETSTORMid:167008
db:PACKETSTORMid:166976
db:PACKETSTORMid:166327
db:PACKETSTORMid:166437
db:PACKETSTORMid:166805
db:PACKETSTORMid:166803
db:PACKETSTORMid:166516
db:CNNVDid:CNNVD-202202-1722
db:NVDid:CVE-2022-23308

LAST UPDATE DATE

2025-04-20T21:48:48.529000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-412332date:2022-11-02T00:00:00
db:CNNVDid:CNNVD-202202-1722date:2023-06-30T00:00:00
db:NVDid:CVE-2022-23308date:2024-11-21T06:48:22.940

SOURCES RELEASE DATE

db:VULHUBid:VHN-412332date:2022-02-26T00:00:00
db:PACKETSTORMid:167008date:2022-05-10T14:49:09
db:PACKETSTORMid:166976date:2022-05-05T17:35:22
db:PACKETSTORMid:166327date:2022-03-16T16:44:24
db:PACKETSTORMid:166437date:2022-03-24T14:40:17
db:PACKETSTORMid:166805date:2022-04-21T15:10:14
db:PACKETSTORMid:166803date:2022-04-21T15:09:54
db:PACKETSTORMid:166516date:2022-03-29T15:53:19
db:CNNVDid:CNNVD-202202-1722date:2022-02-21T00:00:00
db:NVDid:CVE-2022-23308date:2022-02-26T05:15:08.280