SB2022071701 - Multiple vulnerabilities in Red Hat Virtualization Manager
Published: July 17, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2021-3807)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when matching crafted invalid ANSI escape codes in ansi-regex. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
2) Incorrect Regular Expression (CVE-ID: CVE-2021-33623)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
3) Infinite loop (CVE-ID: CVE-2021-35515)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when processing 7Z archives. A remote attacker can consume all available system resources and cause denial of service conditions.
4) Resource exhaustion (CVE-ID: CVE-2021-35516)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing 7Z archives. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
5) Resource exhaustion (CVE-ID: CVE-2021-35517)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing TAR archives. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
6) Resource exhaustion (CVE-ID: CVE-2021-36090)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing ZIP archives. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
7) Incorrect Regular Expression (CVE-ID: CVE-2022-22950)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due improper input validation when processing SpEL expressions. A remote attacker can send a specially crafted HTTP request to the affected application and perform a denial of service (DoS) attack.
8) Information disclosure (CVE-ID: CVE-2022-31051)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. A remote attacker can gain unauthorized access to sensitive information on the system.
Remediation
Install update from vendor's website.