what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2022-6696-01

Red Hat Security Advisory 2022-6696-01
Posted Sep 27, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-6696-01 - Red Hat Advanced Cluster Management for Kubernetes 2.4.6 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. Issues addressed include crlf injection and denial of service vulnerabilities.

tags | advisory, denial of service, vulnerability
systems | linux, redhat
advisories | CVE-2015-20107, CVE-2020-28915, CVE-2021-40528, CVE-2022-0391, CVE-2022-1012, CVE-2022-1292, CVE-2022-1586, CVE-2022-1729, CVE-2022-1785, CVE-2022-1897, CVE-2022-1927, CVE-2022-2068, CVE-2022-2097, CVE-2022-21123
SHA-256 | 93b0f967c0fc17f3ba55a522337de68e746328883ab6a3bcc0a9d9569b072751

Red Hat Security Advisory 2022-6696-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Critical: Red Hat Advanced Cluster Management 2.4.6 security update and bug fixes
Advisory ID: RHSA-2022:6696-01
Product: Red Hat ACM
Advisory URL: https://access.redhat.com/errata/RHSA-2022:6696
Issue date: 2022-09-26
CVE Names: CVE-2015-20107 CVE-2020-28915 CVE-2021-40528
CVE-2022-0391 CVE-2022-1012 CVE-2022-1292
CVE-2022-1586 CVE-2022-1729 CVE-2022-1785
CVE-2022-1897 CVE-2022-1927 CVE-2022-2068
CVE-2022-2097 CVE-2022-2526 CVE-2022-21123
CVE-2022-21125 CVE-2022-21166 CVE-2022-22576
CVE-2022-25313 CVE-2022-25314 CVE-2022-27666
CVE-2022-27774 CVE-2022-27776 CVE-2022-27782
CVE-2022-29154 CVE-2022-29824 CVE-2022-30629
CVE-2022-31129 CVE-2022-31150 CVE-2022-31151
CVE-2022-32206 CVE-2022-32208 CVE-2022-32250
CVE-2022-34903 CVE-2022-36067
=====================================================================

1. Summary:

Red Hat Advanced Cluster Management for Kubernetes 2.4.6 General
Availability release images, which fix bugs and update container images.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat Advanced Cluster Management for Kubernetes 2.4.6 images

Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which fix several security issues and several
bugs. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/

Security fixes:

* golang: crypto/tls: session tickets lack random ticket_age_add
(CVE-2022-30629)

* moment: inefficient parsing algorithim resulting in DoS (CVE-2022-31129)

* nodejs16: CRLF injection in node-undici (CVE-2022-31150)

* nodejs/undici: Cookie headers uncleared on cross-origin redirect
(CVE-2022-31151)

* vm2: Sandbox Escape in vm2 (CVE-2022-36067)

Bug fixes:

* RHACM 2.4 using deprecated APIs in managed clusters (BZ# 2041540)

* vSphere network name doesn't allow entering spaces and doesn't reflect
YAML changes (BZ# 2074766)

* cluster update status is stuck, also update is not even visible (BZ#
2079418)

* Policy that creates cluster role is showing as not compliant due to
Request entity too large message (BZ# 2088486)

* Upgraded from RHACM 2.2-->2.3-->2.4 and cannot create cluster (BZ#
2089490)

* ACM Console Becomes Unusable After a Time (BZ# 2097464)

* RHACM 2.4.6 images (BZ# 2100613)

* Cluster Pools with conflicting name of existing clusters in same
namespace fails creation and deletes existing cluster (BZ# 2102436)

* ManagedClusters in Pending import state after ACM hub migration (BZ#
2102495)

3. Solution:

For Red Hat Advanced Cluster Management for Kubernetes, see the following
documentation, which will be updated shortly for this release, for
important
instructions on installing this update:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html-single/install/index#installing

4. Bugs fixed (https://bugzilla.redhat.com/):

2041540 - RHACM 2.4 using deprecated APIs in managed clusters
2074766 - vSphere network name doesn't allow entering spaces and doesn't reflect YAML changes
2079418 - cluster update status is stuck, also update is not even visible
2088486 - Policy that creates cluster role is showing as not compliant due to Request entity too large message
2089490 - Upgraded from RHACM 2.2-->2.3-->2.4 and cannot create cluster
2092793 - CVE-2022-30629 golang: crypto/tls: session tickets lack random ticket_age_add
2097464 - ACM Console Becomes Unusable After a Time
2100613 - RHACM 2.4.6 images
2102436 - Cluster Pools with conflicting name of existing clusters in same namespace fails creation and deletes existing cluster
2102495 - ManagedClusters in Pending import state after ACM hub migration
2105075 - CVE-2022-31129 moment: inefficient parsing algorithm resulting in DoS
2109354 - CVE-2022-31150 nodejs16: CRLF injection in node-undici
2121396 - CVE-2022-31151 nodejs/undici: Cookie headers uncleared on cross-origin redirect
2124794 - CVE-2022-36067 vm2: Sandbox Escape in vm2

5. References:

https://access.redhat.com/security/cve/CVE-2015-20107
https://access.redhat.com/security/cve/CVE-2020-28915
https://access.redhat.com/security/cve/CVE-2021-40528
https://access.redhat.com/security/cve/CVE-2022-0391
https://access.redhat.com/security/cve/CVE-2022-1012
https://access.redhat.com/security/cve/CVE-2022-1292
https://access.redhat.com/security/cve/CVE-2022-1586
https://access.redhat.com/security/cve/CVE-2022-1729
https://access.redhat.com/security/cve/CVE-2022-1785
https://access.redhat.com/security/cve/CVE-2022-1897
https://access.redhat.com/security/cve/CVE-2022-1927
https://access.redhat.com/security/cve/CVE-2022-2068
https://access.redhat.com/security/cve/CVE-2022-2097
https://access.redhat.com/security/cve/CVE-2022-2526
https://access.redhat.com/security/cve/CVE-2022-21123
https://access.redhat.com/security/cve/CVE-2022-21125
https://access.redhat.com/security/cve/CVE-2022-21166
https://access.redhat.com/security/cve/CVE-2022-22576
https://access.redhat.com/security/cve/CVE-2022-25313
https://access.redhat.com/security/cve/CVE-2022-25314
https://access.redhat.com/security/cve/CVE-2022-27666
https://access.redhat.com/security/cve/CVE-2022-27774
https://access.redhat.com/security/cve/CVE-2022-27776
https://access.redhat.com/security/cve/CVE-2022-27782
https://access.redhat.com/security/cve/CVE-2022-29154
https://access.redhat.com/security/cve/CVE-2022-29824
https://access.redhat.com/security/cve/CVE-2022-30629
https://access.redhat.com/security/cve/CVE-2022-31129
https://access.redhat.com/security/cve/CVE-2022-31150
https://access.redhat.com/security/cve/CVE-2022-31151
https://access.redhat.com/security/cve/CVE-2022-32206
https://access.redhat.com/security/cve/CVE-2022-32208
https://access.redhat.com/security/cve/CVE-2022-32250
https://access.redhat.com/security/cve/CVE-2022-34903
https://access.redhat.com/security/cve/CVE-2022-36067
https://access.redhat.com/security/updates/classification/#critical

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYzH0j9zjgjWX9erEAQjV3w/+OF8DMlMu34xmKbbhZ3feepdH06CvnKpN
JZjnO16620E+eAJD5Cn+uKUXFEuSvz/JWAkIX9w2C0Z5tiKiwd5ggpiquFRSKYBv
GK3NXD4GoRxkMbFxJPlM/iaId7JbNR89/kaJDYnWVmqlF6JrJi6mVxPbOrAkMq2g
anQzh/RwQ9GkK9SmYHicwzRJpsVDvkm7lCcaAk6viVzdXITwG3rHqjc4v0soY48w
n+hY1oEUi7wfMc+yUQBGU/Sc91jhcQ0HGppi8lBSZzH3VS5D0xyTnSJQ6++FE8Li
hkl3aRD39YhUNrDYHgtMLyfF09cJ8CiTGc7XSeA4KmiMcZyKIHv05Xn85De6nn75
SE/Xo8JyDxp9tOlk3BOhFCC1lnv8t/YgKPz41s0mdlhSqfIqBiTjrLpWYZFpqLTP
vtu5TU3ayHTuuKwGQ1c3OOaIhffxTkA3E9PdK2n4/dyW8tUE3tuAJppcv4FIbpTF
ejenradoq4GNiR0RyUmNElY1sFlXdzBvP0LThjRJg72AyjvJPOfrYzWt/jMRukbV
WJr7hMp7naL3pBWMeuUEyCexeYR+WbHtZk/PHZyI14dIFs0KEzKeaWjCgFHwIHEH
tKjjMX5PLe3vgM61OHunO4C5SZvWvJZBhTGOuhEX6u3cHLgF9CeVq7CPlHXKKr3t
x6qljk3DN3s=
=aNSP
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    14 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    11 Files
  • 8
    Dec 8th
    36 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close