Missing Release of Resource after Effective Lifetime Affecting container-tools:rhel8/podman-gvproxy package, versions <2:4.0.2-6.module+el8.6.0+14673+621cb8be


Severity

Recommended
0.0
high
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.79% (83rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-CONTAINERTOOLS-4211613
  • published24 Mar 2022
  • disclosed15 Feb 2022

Introduced: 15 Feb 2022

CVE-2022-21698  (opens in a new tab)
CWE-772  (opens in a new tab)

How to fix?

Upgrade RHEL:8 container-tools:rhel8/podman-gvproxy to version 2:4.0.2-6.module+el8.6.0+14673+621cb8be or higher.
This issue was patched in RHSA-2022:1762.

NVD Description

Note: Versions mentioned in the description apply only to the upstream container-tools:rhel8/podman-gvproxy package and not the container-tools:rhel8/podman-gvproxy package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

References

CVSS Scores

version 3.1