exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2023-4875-01

Red Hat Security Advisory 2023-4875-01
Posted Aug 30, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-4875-01 - Red Hat Advanced Cluster Management for Kubernetes 2.8.1 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide security updates and fix several bugs. Issues addressed include bypass and privilege escalation vulnerabilities.

tags | advisory, vulnerability
systems | linux, redhat
advisories | CVE-2020-24736, CVE-2023-1667, CVE-2023-2283, CVE-2023-24329, CVE-2023-2602, CVE-2023-2603, CVE-2023-26604, CVE-2023-27536, CVE-2023-28321, CVE-2023-28484, CVE-2023-29469, CVE-2023-3027, CVE-2023-3089, CVE-2023-32681
SHA-256 | 4278174f93c1d772f4a823ea8170dcf6ceef2f9e3533e105e7415d7d54b22ead

Red Hat Security Advisory 2023-4875-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Critical: Red Hat Advanced Cluster Management 2.8.1 security and bug fix updates
Advisory ID: RHSA-2023:4875-01
Product: Red Hat ACM
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4875
Issue date: 2023-08-30
CVE Names: CVE-2020-24736 CVE-2023-1667 CVE-2023-2283
CVE-2023-2602 CVE-2023-2603 CVE-2023-3027
CVE-2023-3089 CVE-2023-3899 CVE-2023-24329
CVE-2023-26604 CVE-2023-27536 CVE-2023-28321
CVE-2023-28484 CVE-2023-29469 CVE-2023-32681
CVE-2023-34969 CVE-2023-37466 CVE-2023-37903
CVE-2023-38408
=====================================================================

1. Summary:

Red Hat Advanced Cluster Management for Kubernetes 2.8.1 General
Availability release images, which provide security updates and fix bugs.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE links in the References section.

2. Description:

Red Hat Advanced Cluster Management for Kubernetes 2.8.1 images

Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which provide security updates and fix several
bugs. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.8/html/release_notes/

Security fix(es):
* CVE-2023-3089 - openshift: OCP & FIPS mode
* CVE-2023-37903 - vm2: custom inspect function allows attackers to escape
the sandbox and run arbitrary code
* CVE-2023-37466 - vm2: Promise handler sanitization can be bypassed
allowing attackers to escape the sandbox and run arbitrary code
* CVE-2023-3027 - ACM: governance policy propagator privilege escalation

3. Solution:

For information and instructions for these updates, see the following
article: https://access.redhat.com/solutions/7022540.

For Red Hat Advanced Cluster Management for Kubernetes, see the following
documentation, which will be updated shortly for this release, for
important
instructions on installing this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.8/html-single/install/index#installing

4. Bugs fixed (https://bugzilla.redhat.com/):

2211468 - CVE-2023-3027 ACM: governance policy propagator privilege escalation
2212085 - CVE-2023-3089 openshift: OCP & FIPS mode
2224969 - CVE-2023-37903 vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code
2232376 - CVE-2023-37466 vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code

5. References:

https://access.redhat.com/security/cve/CVE-2020-24736
https://access.redhat.com/security/cve/CVE-2023-1667
https://access.redhat.com/security/cve/CVE-2023-2283
https://access.redhat.com/security/cve/CVE-2023-2602
https://access.redhat.com/security/cve/CVE-2023-2603
https://access.redhat.com/security/cve/CVE-2023-3027
https://access.redhat.com/security/cve/CVE-2023-3089
https://access.redhat.com/security/cve/CVE-2023-3899
https://access.redhat.com/security/cve/CVE-2023-24329
https://access.redhat.com/security/cve/CVE-2023-26604
https://access.redhat.com/security/cve/CVE-2023-27536
https://access.redhat.com/security/cve/CVE-2023-28321
https://access.redhat.com/security/cve/CVE-2023-28484
https://access.redhat.com/security/cve/CVE-2023-29469
https://access.redhat.com/security/cve/CVE-2023-32681
https://access.redhat.com/security/cve/CVE-2023-34969
https://access.redhat.com/security/cve/CVE-2023-37466
https://access.redhat.com/security/cve/CVE-2023-37903
https://access.redhat.com/security/cve/CVE-2023-38408
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/RHSB-2023-001

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJk71bEAAoJENzjgjWX9erEfB8QAJs8e6iJGQX2i0QYRabaZ7tN
pIwg6E1lSTz44XBBbJzLjaUSa6oPyRFBJIOWiPzpbMALIgj8IjuartxH6IuYHVqZ
RUmoDjAkt8KftV2VZ7v4Gy/qFOTAy/o+l7boq1C6JZ01wBDOYwKo4SI5m0t/dwPh
l8a7mDfKD9uQeGjr/F9nbSB9l4CS3dVVzQOycaPu9FdpizYfD2ZlDjmwMoIiqf0I
tqNRFy241LeYTyc2G9AtUFxUp4DO9psS5+aFf+3jLWVLFT5AnAykN1RWCbwi8Hdl
l2TSuwOEJVW2xxGqpHuuxgeyrnhjLZKWEaJagujx1q643eC7aVYnzVXeIhe860/E
7hgriIERBQ2AuI2mfizoMTLjVsoxfJ2F+dfSQr35WJ04G2V+5BrBEvuCwANzy9e5
/b4jKb7r777f6JrlGy+yasCQS1gIWmObf7VBL0GYBxrePxBbFIrCEfJJgkfq5dM6
yX+YCiwq3c/XfUIoR8FrSOrfL1X1W4MVbB/0tLMJyTZzIij7xx2m6HkMwxkB5T42
OfOlAstohLS06gW+Fwi92bmOYk/PKLc/+izyqJTZRfb6NnayWL6ycVRngXfdibBU
wabn0eZp+JSqp5LO/tchkAGjBDqy2WXMpOx2kl8eQ4jQv2hoU52U2q6bxmF2W96G
kVOx0vxaOxzTVHciE92T
=I0do
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close