what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2023-0693-01

Red Hat Security Advisory 2023-0693-01
Posted Feb 9, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-0693-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Issues addressed include a denial of service vulnerability.

tags | advisory, web, denial of service
systems | linux, redhat
advisories | CVE-2021-4235, CVE-2021-43138, CVE-2021-46848, CVE-2022-2056, CVE-2022-2057, CVE-2022-2058, CVE-2022-2519, CVE-2022-2520, CVE-2022-2521, CVE-2022-27664, CVE-2022-2867, CVE-2022-2868, CVE-2022-2869, CVE-2022-2879
SHA-256 | 4cfa93a9c8eec59671cef9eab6c0c285ebe2bcaf6a8c559a999651c9ddbf94f2

Red Hat Security Advisory 2023-0693-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Migration Toolkit for Containers (MTC) 1.7.7 security and bug fix update
Advisory ID: RHSA-2023:0693-01
Product: Red Hat Migration Toolkit
Advisory URL: https://access.redhat.com/errata/RHSA-2023:0693
Issue date: 2023-02-09
CVE Names: CVE-2021-4235 CVE-2021-43138 CVE-2021-46848
CVE-2022-2056 CVE-2022-2057 CVE-2022-2058
CVE-2022-2519 CVE-2022-2520 CVE-2022-2521
CVE-2022-2867 CVE-2022-2868 CVE-2022-2869
CVE-2022-2879 CVE-2022-2880 CVE-2022-2953
CVE-2022-2995 CVE-2022-3162 CVE-2022-3172
CVE-2022-3259 CVE-2022-3466 CVE-2022-3821
CVE-2022-4883 CVE-2022-27664 CVE-2022-30631
CVE-2022-32148 CVE-2022-32149 CVE-2022-32189
CVE-2022-32190 CVE-2022-35737 CVE-2022-40303
CVE-2022-40304 CVE-2022-41715 CVE-2022-41717
CVE-2022-42010 CVE-2022-42011 CVE-2022-42012
CVE-2022-43680 CVE-2022-44617 CVE-2022-46285
=====================================================================

1. Summary:

The Migration Toolkit for Containers (MTC) 1.7.7 is now available.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

The Migration Toolkit for Containers (MTC) enables you to migrate
Kubernetes resources, persistent volume data, and internal container images
between OpenShift Container Platform clusters, using the MTC web console or
the Kubernetes API.

Security Fix(es) from Bugzilla:

* async: Prototype Pollution in async (CVE-2021-43138)

* golang: archive/tar: unbounded memory consumption when reading headers
(CVE-2022-2879)

* golang: net/http/httputil: ReverseProxy should not forward unparseable
query parameters (CVE-2022-2880)

* golang: net/http: handle server errors after sending GOAWAY
(CVE-2022-27664)

* golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time
to parse complex tags (CVE-2022-32149)

* golang: net/url: JoinPath does not strip relative path components in all
circumstances (CVE-2022-32190)

* golang: regexp/syntax: limit memory used by parsing regexps
(CVE-2022-41715)

* golang: net/http: An attacker can cause excessive memory growth in a Go
server accepting HTTP/2 requests (CVE-2022-41717)

* golang: math/big: decoding big.Float and big.Rat types can panic if the
encoded message is too short, potentially allowing a denial of service
(CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

3. Solution:

For details on how to install and use MTC, refer to:

https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html

4. Bugs fixed (https://bugzilla.redhat.com/):

2113814 - CVE-2022-32189 golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service
2124668 - CVE-2022-32190 golang: net/url: JoinPath does not strip relative path components in all circumstances
2124669 - CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
2126276 - CVE-2021-43138 async: Prototype Pollution in async
2132867 - CVE-2022-2879 golang: archive/tar: unbounded memory consumption when reading headers
2132868 - CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
2132872 - CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
2134010 - CVE-2022-32149 golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags
2160662 - Velero pod crashing leading to migrations being stuck during Backup Phase
2161274 - CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests

5. JIRA issues fixed (https://issues.jboss.org/):

MIG-1275 - Update base image for hook-runner so kubernetes.core 2.3.2 or newer is present
MIG-1281 - Allow DVM to be configured with alternative network strategies, more than an openshift route.

6. References:

https://access.redhat.com/security/cve/CVE-2021-4235
https://access.redhat.com/security/cve/CVE-2021-43138
https://access.redhat.com/security/cve/CVE-2021-46848
https://access.redhat.com/security/cve/CVE-2022-2056
https://access.redhat.com/security/cve/CVE-2022-2057
https://access.redhat.com/security/cve/CVE-2022-2058
https://access.redhat.com/security/cve/CVE-2022-2519
https://access.redhat.com/security/cve/CVE-2022-2520
https://access.redhat.com/security/cve/CVE-2022-2521
https://access.redhat.com/security/cve/CVE-2022-2867
https://access.redhat.com/security/cve/CVE-2022-2868
https://access.redhat.com/security/cve/CVE-2022-2869
https://access.redhat.com/security/cve/CVE-2022-2879
https://access.redhat.com/security/cve/CVE-2022-2880
https://access.redhat.com/security/cve/CVE-2022-2953
https://access.redhat.com/security/cve/CVE-2022-2995
https://access.redhat.com/security/cve/CVE-2022-3162
https://access.redhat.com/security/cve/CVE-2022-3172
https://access.redhat.com/security/cve/CVE-2022-3259
https://access.redhat.com/security/cve/CVE-2022-3466
https://access.redhat.com/security/cve/CVE-2022-3821
https://access.redhat.com/security/cve/CVE-2022-4883
https://access.redhat.com/security/cve/CVE-2022-27664
https://access.redhat.com/security/cve/CVE-2022-30631
https://access.redhat.com/security/cve/CVE-2022-32148
https://access.redhat.com/security/cve/CVE-2022-32149
https://access.redhat.com/security/cve/CVE-2022-32189
https://access.redhat.com/security/cve/CVE-2022-32190
https://access.redhat.com/security/cve/CVE-2022-35737
https://access.redhat.com/security/cve/CVE-2022-40303
https://access.redhat.com/security/cve/CVE-2022-40304
https://access.redhat.com/security/cve/CVE-2022-41715
https://access.redhat.com/security/cve/CVE-2022-41717
https://access.redhat.com/security/cve/CVE-2022-42010
https://access.redhat.com/security/cve/CVE-2022-42011
https://access.redhat.com/security/cve/CVE-2022-42012
https://access.redhat.com/security/cve/CVE-2022-43680
https://access.redhat.com/security/cve/CVE-2022-44617
https://access.redhat.com/security/cve/CVE-2022-46285
https://access.redhat.com/security/updates/classification/#moderate

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY+RnvtzjgjWX9erEAQj1Uw//Sajfr2eFvjS/4S4vFPjwT4h2vmhZx41v
khxvUYsIiISMIdqGFyeHwGjJIVZvxLeNJFRgFwg7V/x3pK3cFf7mgFLLIFa+jZOy
emzSTft3XWAgdAVw8PkrohPTsg49jJHklXBrekoH1HqKUQVbZxpKBjo5iGHbk+K3
cpUF7ZJoPUa9bRmqE2DIOyQQyKmqivCh61wDQTZjR6S2xOeo0Y666pVl3cOcHpcp
TVGsnO+o3qvqO7PezE6L1znbifO0jL6dsWFHysAKjYl0MR0hFjeloJVRq4QME49r
qeDGGITJXfIAQzbo2CzyaP5Ifmre0O1VIAX5QyE3xhzgdn1JUeDBi3kOH1RLGXvq
oYlkvVhV3xPBH9YK1hmTZalvy79tf9zi24sdk1/U+W/mZz/ZIKqPi+EyB3zio6Tm
buYmultPogNVUWdRGuXxCCr2Alfw400dfmAFXWQ7JWX6XrxCwqz4YsfpZpslFMjT
hYIH+jzVDbA3iL6nOJ3U0JnGo68KlcsnBfbGVkUWrf55O5bJp2N1Yf7KHZTcYonx
QnQID1Xhwjye1pjV7/dCUjBjnXDcVcbfnxExK7AFHih8DBZc9DN3JP/cM1mjK6ab
9hpMRo0NyfP1DNkpCTOFRmxmeiSvZZlxs1STin6XAbIKnIZdFGMWm7cDQgphXIVt
Q40G6CG91Uo=
=8Igd
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close