Headline
Red Hat Security Advisory 2022-1734-01
Red Hat Security Advisory 2022-1734-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Migration Toolkit for Containers (MTC) 1.7.1 security and bug fix update
Advisory ID: RHSA-2022:1734-01
Product: Red Hat Migration Toolkit
Advisory URL: https://access.redhat.com/errata/RHSA-2022:1734
Issue date: 2022-05-05
CVE Names: CVE-2021-3999 CVE-2021-4028 CVE-2021-23177
CVE-2021-31566 CVE-2021-41190 CVE-2021-41771
CVE-2021-41772 CVE-2021-44716 CVE-2021-44717
CVE-2021-45960 CVE-2021-46143 CVE-2022-0261
CVE-2022-0318 CVE-2022-0359 CVE-2022-0361
CVE-2022-0392 CVE-2022-0413 CVE-2022-0778
CVE-2022-1154 CVE-2022-1271 CVE-2022-22822
CVE-2022-22823 CVE-2022-22824 CVE-2022-22825
CVE-2022-22826 CVE-2022-22827 CVE-2022-23218
CVE-2022-23219 CVE-2022-23308 CVE-2022-23852
CVE-2022-25235 CVE-2022-25236 CVE-2022-25315
CVE-2022-25636
====================================================================
- Summary:
The Migration Toolkit for Containers (MTC) 1.7.1 is now available.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
- Description:
The Migration Toolkit for Containers (MTC) enables you to migrate
Kubernetes resources, persistent volume data, and internal container images
between OpenShift Container Platform clusters, using the MTC web console or
the Kubernetes API.
Security Fix(es) from Bugzilla:
golang: net/http: Limit growth of header canonicalization cache
(CVE-2021-44716)golang: debug/macho: Invalid dynamic symbol table command can cause panic
(CVE-2021-41771)golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)
golang: syscall: Don’t close fd 0 on ForkExec error (CVE-2021-44717)
opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
- Solution:
For details on how to install and use MTC, refer to:
https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html
- Bugs fixed (https://bugzilla.redhat.com/):
2020725 - CVE-2021-41771 golang: debug/macho: invalid dynamic symbol table command can cause panic
2020736 - CVE-2021-41772 golang: archive/zip: Reader.Open panics on empty string
2024938 - CVE-2021-41190 opencontainers: OCI manifest and index parsing confusion
2030801 - CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache
2030806 - CVE-2021-44717 golang: syscall: don’t close fd 0 on ForkExec error
2040378 - Don’t allow Storage class conversion migration if source cluster has only one storage class defined [backend]
2057516 - [MTC UI] UI should not allow PVC mapping for Full migration
2060244 - [MTC] DIM registry route need to be exposed to create inter-cluster state migration plans
2060717 - [MTC] Registry pod goes in CrashLoopBackOff several times when MCG Nooba is used as the Replication Repository
2061347 - [MTC] Log reader pod is missing velero and restic pod logs.
2061653 - [MTC UI] Migration Resources section showing pods from other namespaces
2062682 - [MTC] Destination storage class non-availability warning visible in Intra-cluster source to source state-migration migplan.
2065837 - controller_config.yml.j2 merge type should be set to merge (currently using the default strategic)
2071000 - Storage Conversion: UI doesn’t have the ability to skip PVC
2072036 - Migration plan for storage conversion cannot be created if there’s no replication repository
2072186 - Wrong migration type description
2072684 - Storage Conversion: PersistentVolumeClaimTemplates in StatefulSets are not updated automatically after migration
2073496 - Errors in rsync pod creation are not printed in the controller logs
2079814 - [MTC UI] Intra-cluster state migration plan showing a warning on PersistentVolumes page
- References:
https://access.redhat.com/security/cve/CVE-2021-3999
https://access.redhat.com/security/cve/CVE-2021-4028
https://access.redhat.com/security/cve/CVE-2021-23177
https://access.redhat.com/security/cve/CVE-2021-31566
https://access.redhat.com/security/cve/CVE-2021-41190
https://access.redhat.com/security/cve/CVE-2021-41771
https://access.redhat.com/security/cve/CVE-2021-41772
https://access.redhat.com/security/cve/CVE-2021-44716
https://access.redhat.com/security/cve/CVE-2021-44717
https://access.redhat.com/security/cve/CVE-2021-45960
https://access.redhat.com/security/cve/CVE-2021-46143
https://access.redhat.com/security/cve/CVE-2022-0261
https://access.redhat.com/security/cve/CVE-2022-0318
https://access.redhat.com/security/cve/CVE-2022-0359
https://access.redhat.com/security/cve/CVE-2022-0361
https://access.redhat.com/security/cve/CVE-2022-0392
https://access.redhat.com/security/cve/CVE-2022-0413
https://access.redhat.com/security/cve/CVE-2022-0778
https://access.redhat.com/security/cve/CVE-2022-1154
https://access.redhat.com/security/cve/CVE-2022-1271
https://access.redhat.com/security/cve/CVE-2022-22822
https://access.redhat.com/security/cve/CVE-2022-22823
https://access.redhat.com/security/cve/CVE-2022-22824
https://access.redhat.com/security/cve/CVE-2022-22825
https://access.redhat.com/security/cve/CVE-2022-22826
https://access.redhat.com/security/cve/CVE-2022-22827
https://access.redhat.com/security/cve/CVE-2022-23218
https://access.redhat.com/security/cve/CVE-2022-23219
https://access.redhat.com/security/cve/CVE-2022-23308
https://access.redhat.com/security/cve/CVE-2022-23852
https://access.redhat.com/security/cve/CVE-2022-25235
https://access.redhat.com/security/cve/CVE-2022-25236
https://access.redhat.com/security/cve/CVE-2022-25315
https://access.redhat.com/security/cve/CVE-2022-25636
https://access.redhat.com/security/updates/classification/#moderate
https://docs.openshift.com/container-platform/4.10/migration_toolkit_for_containers/mtc-release-notes.html
https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYnQGqNzjgjWX9erEAQjvjQ/8DjxVShzLVHUL15Y7GP03LaJcaPjItRZD
3AWvsyJRN7eUWxjTLPcBXpQK4ssgf+SbnAQyGZGKXyoSZsN6c0JJ4fMPBLxctH1c
VPeAO9Q5OquQQUS3WuYumzUh4vdjO3mpipeHF6L2chY7RIuQYNhxbHRdoPaCby2r
ipUeZ5pNx7b6Ya0C+CW2xM5jMawMO00LfcvjwHTopdrW2FcJkoHa/0Q9PJ5e9Me7
W4gb2+jEUSTu4gqK41Yo5yYRXicb5ZtfeziszjDnlh+ZkoW9rqztJyJwfmzOg54+
NQmslnVTz2Zym69Kdx0Y1erhX6UMU1k5ltQwqiF4G0hCHw8mnlmSTkst9cml18n0
cP3VJeQ4nvwHGI/DK37yqkUyVeQFJWmCJsIeyFlpDqNCnnHEk7emkjia3xxpLubD
tw2uUc8RDLiZnWpATYsQRrXN9/+YKzYrft2gHMEpKBHg4l8CaU3Kq2a+zRjid0HP
G5J2mj7ByL9Do5+5XXC6zOPcufVHdzJity/uXaqcUe/HPcqkn39H5KclbZT1MCpZ
pffm0GeH7vruU1jbKbGOttteVelUBY6zAQoH0zhNFhYhvjHHUTNPSoofSrpb13Jp
tBW066vZ2LlnXb9N9/IApI4D6NSTr/A+jWArl5zALcqinHZC6gsnTF7MyW4L4l3R
PFjfcWlvgH0=wFuW
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered.
The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platform instances. Note that the Cloud Monitoring Console is not impacted.
An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server, leading to cleartext credential disclosure. Afterwards, the authenticated attacker is able to upload a file that overwrites a 3CX service binary, leading to Remote Code Execution as NT AUTHORITY\SYSTEM on Windows installations. Versions prior to version 18, Hotfix 1 Build 18.0.3.461 March 2022, are prone to an additional unauthenticated file system access to C:\Windows\System32.
Red Hat Security Advisory 2022-1739-01 - Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers the containers for the release.
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
An update for is now available for OpenShift Service Mesh 2.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-44906: minimist: prototype pollution * CVE-2022-0235: node-fetch: exposure of sensitive information to an unauthorized actor * CVE-2022-0536: follow-redirects: Exposure of Sensitive Information via Authorization Header leak * CVE-2022-24771: node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery * CVE-2...
Red Hat Security Advisory 2022-1730-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.9.0. Issues addressed include a bypass vulnerability.
Red Hat Security Advisory 2022-1726-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.9.0. Issues addressed include a bypass vulnerability.
Red Hat Security Advisory 2022-1727-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.9.0. Issues addressed include a bypass vulnerability.
Red Hat Security Advisory 2022-1724-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.9.0. Issues addressed include a bypass vulnerability.
Red Hat Security Advisory 2022-1725-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.9.0. Issues addressed include a bypass vulnerability.
Red Hat Security Advisory 2022-1716-01 - Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. Issues addressed include bypass, crlf injection, and memory leak vulnerabilities.
Red Hat Security Advisory 2022-1715-01 - Red Hat Advanced Cluster Management for Kubernetes 2.3.10 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs. Issues addressed include bypass and traversal vulnerabilities.
Red Hat Security Advisory 2022-1620-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.6.57. Issues addressed include bypass and denial of service vulnerabilities.
Red Hat Security Advisory 2022-1713-01 - The rh-sso-7/sso75-openshift-rhel8 container image has been updated for RHEL-8 based Middleware Containers. Issues addressed include a privilege escalation vulnerability.