Security
Headlines
HeadlinesLatestCVEs

Headline

RHSA-2022:1476: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.4.3 General Availability release images. This update provides security fixes, bug fixes, and updates the container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

  • CVE-2021-23566: nanoid: Information disclosure via valueOf() function
  • CVE-2021-41190: opencontainers: OCI manifest and index parsing confusion
  • CVE-2021-43565: golang.org/x/crypto: empty plaintext packet causes panic
  • CVE-2022-0144: nodejs-shelljs: improper privilege management
  • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
  • CVE-2022-0235: node-fetch: exposure of sensitive information to an unauthorized actor
  • CVE-2022-0536: follow-redirects: Exposure of Sensitive Information via Authorization Header leak
  • CVE-2022-0778: openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  • CVE-2022-24450: nats-server: misusing the “dynamically provisioned sandbox accounts” feature authenticated user can obtain the privileges of the System account
  • CVE-2022-24778: imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path
  • CVE-2022-27191: golang: crash in a golang.org/x/crypto/ssh server
Red Hat Security Data
Open in Source
#vulnerability#red_hat#nodejs#js#kubernetes

Issued:

2022-04-20

Updated:

2022-04-20

RHSA-2022:1476 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Moderate: Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes

Type/Severity

Security Advisory: Moderate

Topic

Red Hat Advanced Cluster Management for Kubernetes 2.4.3 General Availability release images. This update provides security fixes, bug fixes, and updates the container images.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.

Description

Red Hat Advanced Cluster Management for Kubernetes 2.4.3 images

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide some security fixes and bug fixes. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/

Security updates:

  • golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565)
  • nats-server: misusing the “dynamically provisioned sandbox accounts” feature authenticated user can obtain the privileges of the System account (CVE-2022-24450)
  • nanoid: Information disclosure via valueOf() function (CVE-2021-23566)
  • nodejs-shelljs: improper privilege management (CVE-2022-0144)
  • search-ui-container: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor (CVE-2022-0155)
  • node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
  • follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536)
  • openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)
  • imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path (CVE-2022-24778)
  • golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
  • opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

Related bugs:

  • RHACM 2.4.3 image files (BZ #2057249)
  • Observability - dashboard name contains `/` would cause error when generating dashboard cm (BZ #2032128)
  • ACM application placement fails after renaming the application name (BZ #2033051)
  • Disable the obs metric collect should not impact the managed cluster upgrade (BZ #2039197)
  • Observability - cluster list should only contain OCP311 cluster on OCP311 dashboard (BZ #2039820)
  • The value of name label changed from clusterclaim name to cluster name (BZ #2042223)
  • VMWare Cluster creation does not accept ecdsa-sha2-nistp521 ssh keys (BZ #2048500)
  • clusterSelector matchLabels spec are cleared when changing app name/namespace during creating an app in UI (BZ #2053211)
  • Application cluster status is not updated in UI after restoring (BZ #2053279)
  • OpenStack cluster creation is using deprecated floating IP config for 4.7+ (BZ #2056610)
  • The value of Vendor reported by cluster metrics was Other even if the vendor label in managedcluster was Openshift (BZ #2059039)
  • Subscriptions stop reconciling after channel secrets are recreated (BZ #2059954)
  • Placementrule is not reconciling on a new fresh environment (BZ #2074156)
  • The cluster claimed from clusterpool cannot auto imported (BZ #2074543)

Affected Products

  • Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 8 x86_64
  • Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 7 x86_64

Fixes

  • BZ - 2024938 - CVE-2021-41190 opencontainers: OCI manifest and index parsing confusion
  • BZ - 2030787 - CVE-2021-43565 golang.org/x/crypto: empty plaintext packet causes panic
  • BZ - 2032128 - Observability - dashboard name contains `/` would cause error when generating dashboard cm
  • BZ - 2033051 - ACM application placement fails after renaming the application name
  • BZ - 2039197 - disable the obs metric collect should not impact the managed cluster upgrade
  • BZ - 2039820 - Observability - cluster list should only contain OCP311 cluster on OCP311 dashboard
  • BZ - 2042223 - the value of name label changed from clusterclaim name to cluster name
  • BZ - 2043535 - CVE-2022-0144 nodejs-shelljs: improper privilege management
  • BZ - 2044556 - CVE-2022-0155 follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
  • BZ - 2044591 - CVE-2022-0235 node-fetch: exposure of sensitive information to an unauthorized actor
  • BZ - 2048500 - VMWare Cluster creation does not accept ecdsa-sha2-nistp521 ssh keys
  • BZ - 2050853 - CVE-2021-23566 nanoid: Information disclosure via valueOf() function
  • BZ - 2052573 - CVE-2022-24450 nats-server: misusing the “dynamically provisioned sandbox accounts” feature authenticated user can obtain the privileges of the System account
  • BZ - 2053211 - clusterSelector matchLabels spec are cleared when changing app name/namespace during creating an app in UI
  • BZ - 2053259 - CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak
  • BZ - 2053279 - Application cluster status is not updated in UI after restoring
  • BZ - 2056610 - OpenStack cluster creation is using deprecated floating IP config for 4.7+
  • BZ - 2057249 - RHACM 2.4.3 images
  • BZ - 2059039 - The value of Vendor reported by cluster metrics was Other even if the vendor label in managedcluster was Openshift
  • BZ - 2059954 - Subscriptions stop reconciling after channel secrets are recreated
  • BZ - 2062202 - CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  • BZ - 2064702 - CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server
  • BZ - 2069368 - CVE-2022-24778 imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path
  • BZ - 2074156 - Placementrule is not reconciling on a new fresh environment
  • BZ - 2074543 - The cluster claimed from clusterpool can not auto imported

CVEs

  • CVE-2021-0920
  • CVE-2021-3999
  • CVE-2021-4154
  • CVE-2021-23177
  • CVE-2021-23566
  • CVE-2021-31566
  • CVE-2021-41190
  • CVE-2021-43565
  • CVE-2021-45960
  • CVE-2021-46143
  • CVE-2022-0144
  • CVE-2022-0155
  • CVE-2022-0235
  • CVE-2022-0261
  • CVE-2022-0318
  • CVE-2022-0330
  • CVE-2022-0359
  • CVE-2022-0361
  • CVE-2022-0392
  • CVE-2022-0413
  • CVE-2022-0435
  • CVE-2022-0492
  • CVE-2022-0516
  • CVE-2022-0536
  • CVE-2022-0778
  • CVE-2022-0811
  • CVE-2022-0847
  • CVE-2022-22822
  • CVE-2022-22823
  • CVE-2022-22824
  • CVE-2022-22825
  • CVE-2022-22826
  • CVE-2022-22827
  • CVE-2022-22942
  • CVE-2022-23218
  • CVE-2022-23219
  • CVE-2022-23308
  • CVE-2022-23852
  • CVE-2022-24450
  • CVE-2022-24778
  • CVE-2022-25235
  • CVE-2022-25236
  • CVE-2022-25315
  • CVE-2022-27191

References

  • https://access.redhat.com/security/updates/classification/#moderate
  • https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/index
  • https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html-single/install/index#installing

Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 8

SRPM

x86_64

Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 7

SRPM

x86_64

The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.

Related news

Congratulations and New Swag Awards for the Top MSRC 2022 Q1 Security Researchers!

Today, we are excited to recognize this quarter’s Microsoft Researcher Recognition Program leaderboard and share new swag awards and improvements to the leaderboard. Congratulations and thank you to everyone for your hard work and continued partnership to secure customers. The top three researchers of the 2022 Q1 Security Researcher Leaderboard are: Yuki Chen, William Söderberg, … Congratulations and New Swag Awards for the Top MSRC 2022 Q1 Security Researchers! Read More »

Red Hat Security Advisory 2022-1476-01

Red Hat Security Advisory 2022-1476-01 - Red Hat Advanced Cluster Management for Kubernetes 2.4.3 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide some security fixes and bug fixes. Issues addressed include an information leakage vulnerability.

Red Hat Security Advisory 2022-1363-01

Red Hat Security Advisory 2022-1363-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.9.29.

Red Hat Security Advisory 2022-1389-01

Red Hat Security Advisory 2022-1389-01 - This release adds the new Apache HTTP Server 2.4.37 Service Pack 11 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Service Pack 10 and includes bug fixes and enhancements. Issues addressed include HTTP request smuggling, buffer overflow, bypass, null pointer, and use-after-free vulnerabilities.

Red Hat Security Advisory 2022-1390-01

Red Hat Security Advisory 2022-1390-01 - Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release adds the new Apache HTTP Server 2.4.37 Service Pack 11 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Service Pack 10 and includes bug fixes and enhancements. Issues addressed include HTTP request smuggling, buffer overflow, bypass, null pointer, and use-after-free vulnerabilities.

Red Hat Security Advisory 2022-1478-01

Red Hat Security Advisory 2022-1478-01 - Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments.

Red Hat Security Advisory 2022-1455-01

Red Hat Security Advisory 2022-1455-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include out of bounds write and privilege escalation vulnerabilities.

Red Hat Security Advisory 2022-1469-01

Red Hat Security Advisory 2022-1469-01 - Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.5.2 serves as a replacement for Red Hat Single Sign-On 7.5.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include a denial of service vulnerability.

Red Hat Security Advisory 2022-1463-01

Red Hat Security Advisory 2022-1463-01 - Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.5.2 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.5.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include a denial of service vulnerability.

Red Hat Security Advisory 2022-1336-01

Red Hat Security Advisory 2022-1336-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. Issues addressed include a denial of service vulnerability.

RHSA-2022:1356: Red Hat Security Advisory: OpenShift Container Platform 4.10.10 bug fix and security update

Red Hat OpenShift Container Platform release 4.10.10 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-21698: prometheus/client_golang: Denial of service using InstrumentHandlerCounter

Red Hat Security Data: Latest News

RHSA-2023:5627: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
Red Hat Security Data