<p>There is no fixed version for <code>Centos:8</code> <code>podman-manpages</code>.</p>

Missing Release of Resource after Effective Lifetime Affecting podman-manpages package, versions *

Threat Intelligence

0.79% (82^nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-CENTOS8-PODMANMANPAGES-2432470
published 24 Mar 2022
disclosed 15 Feb 2022

Report a new vulnerability Found a mistake?

Introduced: 15 Feb 2022

CVE-2022-21698 Open this link in a new tab CWE-772 Open this link in a new tab

How to fix?

There is no fixed version for Centos:8 podman-manpages.

NVD Description

Note: Versions mentioned in the description apply only to the upstream podman-manpages package and not the podman-manpages package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

None
Integrity (I)

None
Availability (A)

High

Missing Release of Resource after Effective Lifetime Affecting podman-manpages package, versions *

Severity

Based on CentOS security rating