VulnerableCode Package Details - pkg:rpm/redhat/ose-cluster-storage-operator-container@4.13.0-202305181415.p0.g6479617.assembly?arch=stream

Search for packages

Vulnerability	Summary	Fixed by
VCID-eqgm-913k-aaae Aliases: CVE-2021-36157 GHSA-jphm-g89m-v42p	An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)	There are no reported fixed by versions.
VCID-s48v-93da-aaaf Aliases: CVE-2022-41723 GHSA-vvpx-j8f3-3w6h	A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.	There are no reported fixed by versions.
VCID-zwfx-pswj-aaac Aliases: CVE-2022-41722	A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-eqgm-913k-aaae
Aliases:
CVE-2021-36157
GHSA-jphm-g89m-v42p

An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)

There are no reported fixed by versions.

VCID-s48v-93da-aaaf
Aliases:
CVE-2022-41723
GHSA-vvpx-j8f3-3w6h

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

There are no reported fixed by versions.

VCID-zwfx-pswj-aaac
Aliases:
CVE-2022-41722

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk	4.0