{
  "threat_severity" : "Moderate",
  "public_date" : "2022-10-11T00:00:00Z",
  "bugzilla" : {
    "description" : "golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags",
    "id" : "2134010",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2134010"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-407",
  "details" : [ "An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.", "A vulnerability was found in the golang.org/x/text/language package. An attacker can craft an Accept-Language header which ParseAcceptLanguage will take significant time to parse. This issue leads to a denial of service, and can impact availability." ],
  "statement" : "After careful analysis of the vulnerability Redhat is choosing to keep the vulnerability severity as moderate,the vulnerability exists in the ParseAcceptLanguage function of the golang text/language package,when an attacker could craft an unusually large accept header and due to the parser taking quadratic time complexity to finish, firstly the attacker would have to find a way smuggle an input to the parser and even then this would simply not result in a crash of any kind but more of resource hang which while can be unpleasant,does not equate to any real world damage.",
  "affected_release" : [ {
    "product_name" : "Logging subsystem for Red Hat OpenShift 5.4",
    "release_date" : "2022-11-16T00:00:00Z",
    "advisory" : "RHSA-2022:7435",
    "cpe" : "cpe:/a:redhat:logging:5.4::el8",
    "package" : "openshift-logging/elasticsearch-proxy-rhel8:v1.0.0-300"
  }, {
    "product_name" : "OADP-1.0-RHEL-8",
    "release_date" : "2023-02-09T00:00:00Z",
    "advisory" : "RHSA-2023:0692",
    "cpe" : "cpe:/a:redhat:openshift_api_data_protection:1.0::el8",
    "package" : "oadp/oadp-velero-rhel8:1.0.7-5"
  }, {
    "product_name" : "OpenShift Custom Metrics Autoscaler 2",
    "release_date" : "2023-03-06T00:00:00Z",
    "advisory" : "RHSA-2023:1042",
    "cpe" : "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.0::el8",
    "package" : "custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8:2.8.2-143",
    "impact" : "low"
  }, {
    "product_name" : "OpenShift Developer Tools and Services for OCP 4.9",
    "release_date" : "2022-11-03T00:00:00Z",
    "advisory" : "RHSA-2022:7407",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.9::el8",
    "package" : "ocp-tools-4/service-binding-operator-bundle:v1.3.1-7"
  }, {
    "product_name" : "OpenShift Developer Tools and Services for OCP 4.9",
    "release_date" : "2022-11-03T00:00:00Z",
    "advisory" : "RHSA-2022:7407",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.9::el8",
    "package" : "ocp-tools-4/service-binding-rhel8-operator:v1.3.1-5"
  }, {
    "product_name" : "OpenShift Logging 5.3",
    "release_date" : "2022-11-09T00:00:00Z",
    "advisory" : "RHSA-2022:6882",
    "cpe" : "cpe:/a:redhat:logging:5.3::el8",
    "package" : "openshift-logging/elasticsearch-proxy-rhel8:v1.0.0-302"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Extended Update Support",
    "release_date" : "2024-04-23T00:00:00Z",
    "advisory" : "RHSA-2024:1994",
    "cpe" : "cpe:/a:redhat:rhel_eus:8.6",
    "package" : "container-tools:rhel8-8060020240413110723.3b538bd8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Extended Update Support",
    "release_date" : "2024-04-29T00:00:00Z",
    "advisory" : "RHSA-2024:2077",
    "cpe" : "cpe:/a:redhat:rhel_eus:8.8",
    "package" : "container-tools:rhel8-8080020240422101606.0f77c1b7"
  }, {
    "product_name" : "Red Hat Migration Toolkit for Containers 1.7",
    "release_date" : "2023-02-09T00:00:00Z",
    "advisory" : "RHSA-2023:0693",
    "cpe" : "cpe:/a:redhat:rhmt:1.7::el8",
    "package" : "rhmtc/openshift-migration-velero-rhel8:v1.7.7-5"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.12",
    "release_date" : "2023-06-26T00:00:00Z",
    "advisory" : "RHSA-2023:3613",
    "cpe" : "cpe:/a:redhat:openshift:4.12::el8",
    "package" : "podman-3:4.2.0-6.1.rhaos4.12.el8"
  }, {
    "product_name" : "RHEL-7-CNV-4.13",
    "release_date" : "2023-05-18T00:00:00Z",
    "advisory" : "RHSA-2023:3204",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4.13::el7",
    "package" : "kubevirt-0:4.13.0-1469.el7"
  }, {
    "product_name" : "RHEL-8-CNV-4.13",
    "release_date" : "2023-05-18T00:00:00Z",
    "advisory" : "RHSA-2023:3204",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4.13::el8",
    "package" : "kubevirt-0:4.13.0-1469.el8"
  }, {
    "product_name" : "RHEL-9-CNV-4.13",
    "release_date" : "2023-05-18T00:00:00Z",
    "advisory" : "RHSA-2023:3204",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4.13::el9",
    "package" : "kubevirt-0:4.13.0-1469.el9"
  }, {
    "product_name" : "RHEL-9-CNV-4.13",
    "release_date" : "2023-05-18T00:00:00Z",
    "advisory" : "RHSA-2023:3205",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4.13::el9",
    "package" : "container-native-virtualization/virt-api-rhel9:v4.13.0-358"
  }, {
    "product_name" : "RHOL-5.5-RHEL-8",
    "release_date" : "2022-11-10T00:00:00Z",
    "advisory" : "RHSA-2022:7434",
    "cpe" : "cpe:/a:redhat:logging:5.5::el8",
    "package" : "openshift-logging/elasticsearch-proxy-rhel8:v1.0.0-303"
  } ],
  "package_state" : [ {
    "product_name" : "Migration Toolkit for Virtualization",
    "fix_state" : "Not affected",
    "package_name" : "migration-toolkit-virtualization/mtv-must-gather-api-rhel8",
    "cpe" : "cpe:/a:redhat:migration_toolkit_virtualization:2"
  }, {
    "product_name" : "OpenShift Developer Tools and Services",
    "fix_state" : "Will not fix",
    "package_name" : "odo",
    "cpe" : "cpe:/a:redhat:ocp_tools"
  }, {
    "product_name" : "OpenShift Service Mesh 2",
    "fix_state" : "Will not fix",
    "package_name" : "openshift-golang-builder-container",
    "cpe" : "cpe:/a:redhat:service_mesh:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/acm-cluster-proxy-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/acmesolver-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/acm-search-indexer-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/acm-search-v2-api-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/agent-service-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/assisted-installer-agent-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/assisted-installer-reporter-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/assisted-installer-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/cainjector-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/cert-manager-controller-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/cert-manager-webhook-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/config-policy-controller-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/discovery-rhel8-operator",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/gatekeeper-rhel8-operator",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/governance-policy-propagator-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Affected",
    "package_name" : "rhacm2/lighthouse-agent-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Affected",
    "package_name" : "rhacm2/lighthouse-coredns-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/multiclusterhub-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/registration-rhel8-operator",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/subctl-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/submariner-addon-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/submariner-gateway-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/submariner-globalnet-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/submariner-networkplugin-syncer-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/submariner-rhel8-operator",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/submariner-route-agent-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/thanos-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Will not fix",
    "package_name" : "rhacm2/work-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 3",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-main-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:3"
  }, {
    "product_name" : "Red Hat Ceph Storage 3",
    "fix_state" : "Out of support scope",
    "package_name" : "golang",
    "cpe" : "cpe:/a:redhat:ceph_storage:3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "container-tools:3.0/podman",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "container-tools:4.0/podman",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "container-tools:rhel8/podman",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Will not fix",
    "package_name" : "osbuild-composer",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Will not fix",
    "package_name" : "osbuild-composer",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Will not fix",
    "package_name" : "podman",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "ansible-service-broker",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "atomic-enterprise-service-catalog",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "atomic-openshift",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "atomic-openshift-descheduler",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "atomic-openshift-dockerregistry",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "atomic-openshift-service-idler",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "atomic-openshift-web-console",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "openshift-enterprise-autoheal",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "openshift-enterprise-cluster-capacity",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "atomic-openshift-service-idler",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "cri-o",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "cri-tools",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "openshift",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift-golang-builder-container",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform Assisted Installer 1",
    "fix_state" : "Affected",
    "package_name" : "rhai-tech-preview/assisted-installer-rhel8",
    "cpe" : "cpe:/a:redhat:assisted_installer:1"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4",
    "fix_state" : "Affected",
    "package_name" : "odf4/cephcsi-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4"
  }, {
    "product_name" : "Red Hat Quay 3",
    "fix_state" : "Affected",
    "package_name" : "quay/clair-rhel8",
    "cpe" : "cpe:/a:redhat:quay:3"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Out of support scope",
    "package_name" : "golang",
    "cpe" : "cpe:/a:redhat:storage:3"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Out of support scope",
    "package_name" : "go-toolset-7-golang",
    "cpe" : "cpe:/a:redhat:storage:3"
  }, {
    "product_name" : "Self Node Remediation Operator",
    "fix_state" : "Affected",
    "package_name" : "workload-availability/self-node-remediation-rhel8-operator",
    "cpe" : "cpe:/a:redhat:workload_availability_snr:0"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2022-32149\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-32149\nhttps://go.dev/issue/56152\nhttps://groups.google.com/g/golang-dev/c/qfPIly0X7aU" ],
  "name" : "CVE-2022-32149",
  "csaw" : false
}