Denial of service via stack overflow panics
CVE: CVE-2022-21708
Component: graphql-go
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-22T00:00:00+00:00

graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. The issue has been patched in version `v1.3.0`. The only known workaround for this issue is to disable the `graphql.MaxDepth` option from your schema which is not recommended.


Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:22174072f8aaef46f80bded25d5a2bdfa6fd8bb01fc5242a07e550f132cafc5a

      (For s390x architecture)
      The image digest is sha256:7704b30376a598a9f532e2883c1d1de6927384665de2bb2120f4abb54ffaa063

      (For ppc64le architecture)
      The image digest is sha256:879bf487996ec676e7376773724b57b3e29e43c35643ad5c591f03cc89cbdf47

      (For aarch64 architecture)
      The image digest is sha256:5fef7bbd0d0d5f17269de502bf37315d9e1e8d2d95da9a5d654f807029280d75

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.[y]/release_notes/ocp-4-13-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:e58807c46fab369428af73bdfec64ad4b509dcbdb4586694059013c69856e8a5

      (For s390x architecture)
      The image digest is sha256:ce1a217cebc8be9d6872ef6b4058f5b3b80904b4acd1dc519ea57fb072d6bbb4

      (For ppc64le architecture)
      The image digest is sha256:f1597234f6ef6b7831998396d9174502756da2af2cc441c0659b5f57ced36a38

      (For aarch64 architecture)
      The image digest is sha256:36e4d2535e5079c733c987011c74fdae2d3ef206376a8ffc8c35015176619a00

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.[y]/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:671bc35e8fc2027d6f4c2c756d19909d83d55d1c591e8f9ea790ec8da744d171

      (For s390x architecture)
      The image digest is sha256:641ac9df3fbc2575922e68cc2e3b0903d7d268faf6862777fca93ac7ed2fe82b

      (For ppc64le architecture)
      The image digest is sha256:ab24f08a86cb6715e3259153ab44820620d80f21c87781001289bc7ebe13cf02

      (For aarch64 architecture)
      The image digest is sha256:7f3942d330660112a9220786bd2fb3015f05bda0354002f70cf5735e6386b93b

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html