Headline

RHSA-2022:0191: Red Hat Security Advisory: OpenShift Virtualization 4.9.2 Images security and bug fix update

Red Hat OpenShift Virtualization release 4.9.2 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2021-31525: golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header
CVE-2021-33195: golang: net: lookup functions may return invalid host names
CVE-2021-33197: golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty
CVE-2021-33198: golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents
CVE-2021-34558: golang: crypto/tls: certificate of wrong type is causing TLS client to panic

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #web #mac #red_hat #kubernetes

Issued:

2022-01-19

Updated:

2022-01-19

RHSA-2022:0191 - Security Advisory

Overview
Updated Packages

Synopsis

Moderate: OpenShift Virtualization 4.9.2 Images security and bug fix update

Type/Severity

Security Advisory: Moderate

Topic

Red Hat OpenShift Virtualization release 4.9.2 is now available with updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

OpenShift Virtualization is Red Hat’s virtualization solution designed for Red Hat OpenShift Container Platform.

This advisory contains the following OpenShift Virtualization 4.9.2 images:

RHEL-8-CNV-4.9
==============
kubevirt-vmware-container-v4.9.2-1
virtio-win-container-v4.9.2-1
kubemacpool-container-v4.9.2-1
ovs-cni-plugin-container-v4.9.2-1
ovs-cni-marker-container-v4.9.2-1
node-maintenance-operator-container-v4.9.2-1
cnv-containernetworking-plugins-container-v4.9.2-1
hostpath-provisioner-container-v4.9.2-1
bridge-marker-container-v4.9.2-1
kubevirt-template-validator-container-v4.9.2-1
cluster-network-addons-operator-container-v4.9.2-1
kubernetes-nmstate-handler-container-v4.9.2-1
hostpath-provisioner-operator-container-v4.9.2-2
cnv-must-gather-container-v4.9.2-2
virt-cdi-controller-container-v4.9.2-8
virt-cdi-apiserver-container-v4.9.2-8
virt-cdi-uploadserver-container-v4.9.2-8
virt-cdi-operator-container-v4.9.2-8
virt-cdi-uploadproxy-container-v4.9.2-8
virt-cdi-cloner-container-v4.9.2-8
virt-cdi-importer-container-v4.9.2-8
hyperconverged-cluster-webhook-container-v4.9.2-6
hyperconverged-cluster-operator-container-v4.9.2-6
kubevirt-ssp-operator-container-v4.9.2-3
kubevirt-v2v-conversion-container-v4.9.2-2
vm-import-controller-container-v4.9.2-2
vm-import-operator-container-v4.9.2-2
vm-import-virtv2v-container-v4.9.2-2
virt-launcher-container-v4.9.2-7
virt-controller-container-v4.9.2-7
virt-api-container-v4.9.2-7
virt-operator-container-v4.9.2-7
virt-artifacts-server-container-v4.9.2-7
libguestfs-tools-container-v4.9.2-7
virt-handler-container-v4.9.2-7
hco-bundle-registry-container-v4.9.2-27

Security Fix(es):

golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header (CVE-2021-31525)
golang: net: lookup functions may return invalid host names (CVE-2021-33195)
golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)
golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)
golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

Red Hat Container Native Virtualization 4.9 for RHEL 8 x86_64
Red Hat Container Native Virtualization 4.9 for RHEL 7 x86_64

Fixes

BZ - 1954505 - [RFE] Better to have an output message when virtctl addvolume/removevolume to a VM
BZ - 1958341 - CVE-2021-31525 golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header
BZ - 1983596 - CVE-2021-34558 golang: crypto/tls: certificate of wrong type is causing TLS client to panic
BZ - 1989564 - CVE-2021-33195 golang: net: lookup functions may return invalid host names
BZ - 1989570 - CVE-2021-33197 golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty
BZ - 1989575 - CVE-2021-33198 golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents
BZ - 1992961 - Regular user cannot create VM because of an unclear error
BZ - 1995824 - CDI permission error fills up logs
BZ - 2015279 - Hotplugging a second a second block device cause the first one to disappear.
BZ - 2018468 - In an upgraded cluster hco.spec.featureGates.sriovLiveMigration value is not updated to true
BZ - 2022895 - Post upgrade (4.9.0 -> 4.9.1) hostpath provisioner pods are not restarted
BZ - 2026198 - Post upgrade (4.9.1->4.10.0), hco status version did not change
BZ - 2028154 - VM restore fails for VM with runstrategy
BZ - 2030198 - [CNV-4.9.1] must-gather failing to execute /usr/bin/logs.sh script
BZ - 2032853 - 4.9.2 containers