-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   
Red Hat Security Advisory

Synopsis:          Moderate: OpenShift Container Platform 4.7 low-latency extras security and bug fix update
Advisory ID:       RHSA-2020:5364-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:5364
Issue date:        2021-02-24
CVE Names:         CVE-2018-20843 CVE-2019-5018 CVE-2019-13050
                   CVE-2019-13627 CVE-2019-14889 CVE-2019-15165
                   CVE-2019-15903 CVE-2019-16168 CVE-2019-16935
                   CVE-2019-17450 CVE-2019-19221 CVE-2019-19906
                   CVE-2019-19956 CVE-2019-20218 CVE-2019-20387
                   CVE-2019-20388 CVE-2019-20454 CVE-2019-20907
                   CVE-2019-20916 CVE-2020-1730 CVE-2020-1751
                   CVE-2020-1752 CVE-2020-1971 CVE-2020-6405
                   CVE-2020-7595 CVE-2020-8492 CVE-2020-9327
                   CVE-2020-10029 CVE-2020-10722 CVE-2020-10723
                   CVE-2020-10725 CVE-2020-10726 CVE-2020-13630
                   CVE-2020-13631 CVE-2020-13632 CVE-2020-14382
                   CVE-2020-14422 CVE-2020-24659 CVE-2020-25211
                   CVE-2020-27813
====================================================================
1. Summary:

An update for cnf-tests-container, dpdk-base-container,
performance-addon-operator-bundle-registry-container,
performance-addon-operator-container, and
performance-addon-operator-must-gather-rhel8-container is now available for
Red Hat OpenShift Container Platform 4.7.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the extra low-latency container images for Red Hat
OpenShift Container Platform 4.7. See the following advisory for the
container images for this release:

https://access.redhat.com/errata/RHSA-2020:5633

Security Fix(es):

* golang-github-gorilla-websocket: integer overflow leads to denial of
service (CVE-2020-27813)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* Configuring the system with non-RT kernel will hang the system
(BZ#1923220)

3. Solution:

For OpenShift Container Platform 4.7 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel
ease-notes.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1902111 - CVE-2020-27813 golang-github-gorilla-websocket: integer overflow leads to denial of service

5. JIRA issues fixed (https://issues.jboss.org/):

CNF-802 - Infrastructure-provided enablement/disablement of interrupt processing for guaranteed pod CPUs
CNF-854 - Performance tests in CNF Tests

6. References:

https://access.redhat.com/security/cve/CVE-2018-20843
https://access.redhat.com/security/cve/CVE-2019-5018
https://access.redhat.com/security/cve/CVE-2019-13050
https://access.redhat.com/security/cve/CVE-2019-13627
https://access.redhat.com/security/cve/CVE-2019-14889
https://access.redhat.com/security/cve/CVE-2019-15165
https://access.redhat.com/security/cve/CVE-2019-15903
https://access.redhat.com/security/cve/CVE-2019-16168
https://access.redhat.com/security/cve/CVE-2019-16935
https://access.redhat.com/security/cve/CVE-2019-17450
https://access.redhat.com/security/cve/CVE-2019-19221
https://access.redhat.com/security/cve/CVE-2019-19906
https://access.redhat.com/security/cve/CVE-2019-19956
https://access.redhat.com/security/cve/CVE-2019-20218
https://access.redhat.com/security/cve/CVE-2019-20387
https://access.redhat.com/security/cve/CVE-2019-20388
https://access.redhat.com/security/cve/CVE-2019-20454
https://access.redhat.com/security/cve/CVE-2019-20907
https://access.redhat.com/security/cve/CVE-2019-20916
https://access.redhat.com/security/cve/CVE-2020-1730
https://access.redhat.com/security/cve/CVE-2020-1751
https://access.redhat.com/security/cve/CVE-2020-1752
https://access.redhat.com/security/cve/CVE-2020-1971
https://access.redhat.com/security/cve/CVE-2020-6405
https://access.redhat.com/security/cve/CVE-2020-7595
https://access.redhat.com/security/cve/CVE-2020-8492
https://access.redhat.com/security/cve/CVE-2020-9327
https://access.redhat.com/security/cve/CVE-2020-10029
https://access.redhat.com/security/cve/CVE-2020-10722
https://access.redhat.com/security/cve/CVE-2020-10723
https://access.redhat.com/security/cve/CVE-2020-10725
https://access.redhat.com/security/cve/CVE-2020-10726
https://access.redhat.com/security/cve/CVE-2020-13630
https://access.redhat.com/security/cve/CVE-2020-13631
https://access.redhat.com/security/cve/CVE-2020-13632
https://access.redhat.com/security/cve/CVE-2020-14382
https://access.redhat.com/security/cve/CVE-2020-14422
https://access.redhat.com/security/cve/CVE-2020-24659
https://access.redhat.com/security/cve/CVE-2020-25211
https://access.redhat.com/security/cve/CVE-2020-27813
https://access.redhat.com/security/updates/classification/#moderate

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYDaYLtzjgjWX9erEAQj4xA//WESmJ44vrFRO8of5+yK5YHcL9v7/mfsI
rOMeu/8rf0GbRMdx00BI28FUJY+gxZoE9od1HDh3XvsjgOSu5+jui+8ONZ7L7q6z
7fDG/xGFdkJk/5jM4W0Ll+Yaku3z32iG6T11wLZNJnijmp2zpS0QK1lfOOyZZDAW
ZmcptSY91qIsGafeeYTo/aJJKLHH2v/A7O2DYjpBjyf/LnNdVlfmDNPYND6n7YT8
o/LrdW6SvRlORS/1xYEYVYTg+8hQrarX6KwUWF8j+DuP929cimCFoujT1X9J7eGC
LygiTDmtFJaUI02iBHcE6TnCkXk+Zl8H16k7rcEmaMm71csQow+1hZOydtoi3UKO
J0ctqr6eI2dvc6hSB+fHvaNYVxv2I8GFdiFDKMe41VDuk/vrXc03w7IINnDlh5FJ
MU//reSkp6Gow2uKbyZ4BNSjG4XX39MLXWnxPaL8HXIiRqE9LjipIlOyFRNrbZes
8WkCdTaRfrcpJ7c1ocWPWAxDm6C5jW0PV09IjFobiHKkbfZhWCId0w699sAUNrUG
2tfofPrIYy9w8QrjNXccvp5rNg13URBC6k1ORJdxGVxFq6W9N0wEZ/A/YDpVXJ3x
6UbWw/UYbsVq5J6i4qRikluAd33skZk5RdeTARMQEUK7ckc1Eu65v8b2X7dYIy8F
mSI1ReZ0dBM=SQ8X
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce