Withdrawn by the publisher.

Affected: Bitnami: golang

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

go1.19-1.19.6-1.1 on GA media

buildah: possible information disclosure and modification OpenShift: Missing HTTP Strict Transport Security golang: crash in a golang.org/x/crypto/ssh server golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests golang: path/filepath: path-filepath filepath.Clean path traversal golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption haproxy: segfault DoS openshift/apiserver-library-go: Bypass of SCC seccomp profile restrictions podman: symlink exchange attack in podman export volume python-werkzeug: high resource usage when parsing multipart form data with many fields haproxy: request smuggling attack in HTTP/1 header parsing

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um einen Denial of Service Angriff durchzuführen oder Informationen offenzulegen.