-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: OpenShift Container Platform 4.7.5 security and bug fix update
Advisory ID:       RHSA-2021:1005-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:1005
Issue date:        2021-04-05
CVE Names:         CVE-2021-3121 CVE-2021-20206 
=====================================================================

1. Summary:

Red Hat OpenShift Container Platform release 4.7.5 is now available with
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.7.5. See the following advisory for the RPM packages for
this release:

https://access.redhat.com/errata/RHSA-2021:1006

All OpenShift Container Platform 4.7 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift Console
or the CLI oc command. Instructions for upgrading a cluster are available
at
https://docs.openshift.com/container-platform/4.7/updating/updating-cluster
- -between-minor.html#understanding-upgrade-channels_updating-cluster-between
- -minor

Security Fix(es):

* gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index
validation (CVE-2021-3121)

* containernetworking-cni: Arbitrary path injection via type field in CNI
configuration (CVE-2021-20206)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

This update also fixes several bugs. Documentation for these changes is
available from the Release Notes document linked to in the References
section.

You may download the oc tool and use it to inspect release image metadata
as follows:

(For x86_64 architecture)

$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.6.20-x86_64

The image digest is
sha256:0a4c44daf1666f069258aa983a66afa2f3998b78ced79faa6174e0a0f438f0a5

(For s390x architecture)

  $ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.6.20-s390x

The image digest is
sha256:3fc802aafb72402768bbf1b19ce7c6de95256e5cc50799390e63f40d96cec3cd

(For ppc64le architecture)

  $ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.6.20-ppc64le

The image digest is
sha256:5cf6b61198337cd0950e63296be4e48e991721ac17c625f7fd77cf557f08efc7

3. Solution:

For OpenShift Container Platform 4.7 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel
ease-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.7/updating/updating-cluster
- -cli.html.

4. Bugs fixed (https://bugzilla.redhat.com/):

1917904 - [release-4.7] bump k8s.io/apiserver to 1.20.3
1919391 - CVE-2021-20206 containernetworking-cni: Arbitrary path injection via type field in CNI configuration
1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation
1925792 - "Edit Annotation" are not correctly translated in Chinese
1927198 - [e2e][automation] Fix pvc string in pvc.view
1927311 - Performance: Console makes unnecessary requests for en-US messages on load
1927953 - [sig-network-edge][Conformance][Area:Networking][Feature:Router] The HAProxy router should be able to connect to a service that is idled because a GET on the route will unidle it
1928151 - Manually misspelled as Manualy
1928614 - NTO may fail to disable stalld when relying on Tuned '[service]' plugin
1929118 - Update plugins and Jenkins version to prepare openshift-sync-plugin 1.0.46 release
1929246 - Missing info for Operational Status, Provisioning status, BMC, Hostname, ID for BMH for OCP deployed with assisted installer
1929674 - [sig-network] pods should successfully create sandboxes by getting pod
1931382 - Pipelines shown in edit flow for Workloads created via ContainerImage flow
1931520 - multicast traffic is not working on ovn-kubernetes
1931622 - LoadBalancer service check test fails during vsphere upgrade
1931856 - ServiceAccount Registry Authfiles Do Not Contain Entries for Public Hostnames
1932268 - ovn-kubernetes endpoint slice controller doesn't run on CI jobs
1932272 - Items marked as mandatory in KMS Provider form are not enforced
1932277 - Create new pool with arbiter - wrong replica
1932806 - release-4.7: e2e: test OAuth API connections in the tests by that name
1933205 - /usr/lib/dracut/modules.d/30ignition/ignition --version sigsev
1933665 - Getting Forbidden for image in a container template when creating a sample app
1934442 - [release-4.7] Gather info about unhealthy SAP pods
1935070 - (release-4.7) Extend OLM operator gatherer to include Operator/ClusterServiceVersion conditions
1935180 - [4.7z] IGMP/MLD packets being dropped
1935605 - [Backport 4.7] Add memory and uptime metadata to IO archive
1935672 - pipelinerun status icon rendering issue
1935707 - test: Detect when the master pool is still updating after upgrade
1936337 - console operator panics in DefaultDeployment with nil cm
1936802 - (release-4.7) Authentication log gatherer shouldn't scan all the pod logs in the openshift-authentication namespace
1936975 - VSphereProblemDetectorControllerDegraded: context canceled during upgrade to 4.7.0
1937089 - cluster DNS experiencing disruptions during cluster upgrade in insights cluster
1937214 - Ingress operator performs spurious updates in response to API's defaulting of NodePort service's clusterIPs field
1937356 - Incorrect imagestream is shown as selected in knative service container image edit flow
1937375 - [release-4.7] When deploying the operator via OLM (after creating the respective catalogsource), the deployment "lost" the `resources` section.
1938316 - [sig-instrumentation][Late] Alerts shouldn't report any alerts in firing state apart from Watchdog and AlertmanagerReceiversNotConfigured: Prometheus query error
1938921 - Router HAProxy config file template is slow to render due to repetitive regex compilations
1938960 - Permissive Egress NetworkPolicy (0.0.0.0/0) is blocking all traffic
1939061 - [release-4.7] Sap license management logs gatherer 4.7
1939199 - move to go 1.15 and registry.ci.openshift.org
1939608 - FilterToolbar component does not handle 'null' value for 'rowFilters' prop
1940052 - Not all image pulls within OpenShift builds retry
1940806 - [4.7z] CNO: nodes and masters are upgrading simultaneously
1940866 - Add BareMetalPlatformType into e2e upgrade service unsupported list
1941128 - fix co upgradeableFalse status and reason
1941217 - Bare-metal operator is firing for ClusterOperatorDown for 15m during 4.6 to 4.7 upgrade
1941246 - Openshift-apiserver CO unavailable during cluster upgrade from 4.6 to 4.7
1941367 - The containerruntimecontroller doesn't roll back to CR-1 if we delete CR-2
1941468 - (release-4.7) 'More about Insights' link points to support link
1941574 - [sig-network-edge][Conformance][Area:Networking][Feature:Router] The HAProxy router should be able to connect to a service that is idled because a GET on the route will unidle it [Suite:openshift/conformance/parallel/minimal]
1942059 - `oc adm catalog mirror` doesn't work for the air-gapped cluster
1942068 - [release-4.7] Gahter datahubs.installers.datahub.sap.com resources from SAP clusters
1943310 - [SCALE] enable OVN DB memory trimming on compaction

5. References:

https://access.redhat.com/security/cve/CVE-2021-3121
https://access.redhat.com/security/cve/CVE-2021-20206
https://access.redhat.com/security/updates/classification/#moderate

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYGsbdtzjgjWX9erEAQi9Jg//XinGV4VTRIg1jiwdm/c5YjRoEZYln/VI
ITJC7jjMO9TUyuV6WUbllthmxY7uMP/YX0LC6YyC6+7MECUta0sOqN37O2RIFdyV
VQFEzGlpNEIRIUUWM16ZCGX7om5RNFWXtBrya9/oYxNR5ftQr3MY1sO77xCE2tfs
ij0WXVMX+5V0RX2SCy5USSNTWW8ZPk8EasR3yv/rw6jeVo+AnW99plSg8lrHNlWk
Zwo6BlRkO7HGt4gkD+ECBMdKm8ND4ZUx7pcKophVRueNAsFk1M2UCpQC+WpQmXXF
1HNhwCR31HNc5lkR7nfgTDKQRsyzD1N5O4UTdmh1bnMFsgcGE37NX0dmysKPUYuh
DUuI3qc85PfkNb3/9vJvyo+r79/D5s8xsFYbHAXqYlbdeKKS13ztSsxirhwWsZ7x
jwX+UbKrt/PKTVZyyq80VPVeZvLhl/Jq8lJ9BaYEp6BROKqS6lpie7wLayZTxSWS
tCuxO0zoye/HkOzkaWLc9tygVzdJZ/aaDxtMJ+B/nghsv7w+w5/CS9RCqJiFPAz+
t9BkXKWFcqD+fpzjCmSYi4FgG3sFEeSQDIfZlm0+QyVp88tp6Xf96trYqTYdvh7e
1/dn8Wc5zN29Lv7nl5w+Mb+91cZweKQ6a8XbcZGu3v8t0Xs48u0DcYLImvqI7H+4
6Lr59pNFewo=
=qhQn
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce