search-api: SQL injection leads to remote denial of service
Published Sep 1, 2022
6.5
MEDIUMCVSS 3.1
EPSS 0.92%
Description
A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filter gets parsed by the backend. This flaw allows an attacker to craft specific strings containing special characters that lead to crashing the pod and affects system availability while restarting.
Affected products
- Vendor n/a Product Red Hat Advanced Cluster Management for Kubernetes Defaultunknown
Affected
- Red Hat Advanced Cluster Management for Kubernetes 2
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| n/a | Red Hat Advanced Cluster Management for Kubernetes | unknown | Affected
|
- 2.0
No data.
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/search-api-rhel8
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/search-api-rhel8 | Affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
In Red Hat Advanced Cluster Management for Kubernetes (RHACM) the search-api component is protected by OpenShift OAuth which reduces the impact of this flaw to Moderate. Access to the search-api where queries can be submitted requires the user or ServiceAccount token authorization with a granted access to the resources and managed clusters.
References (5)
- https://access.redhat.com/security/cve/CVE-2022-2238 x_refsource_MISCVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2101669 x_refsource_MISCIssue TrackingVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34516 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-2238
- https://www.cve.org/CVERecord?id=CVE-2022-2238
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-2238 | x_refsource_MISCVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2101669 | x_refsource_MISCIssue TrackingVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34516 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2022-2238 | ||
| https://www.cve.org/CVERecord?id=CVE-2022-2238 |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
No data
GitHub
No data