-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   
Red Hat Security Advisory

Synopsis:          Moderate: OpenShift Virtualization 4.13.0 RPMs security and bug fix update
Advisory ID:       RHSA-2023:3204-01
Product:           OpenShift Virtualization
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3204
Issue date:        2023-05-18
CVE Names:         CVE-2022-27664 CVE-2022-32149 CVE-2022-32189
                   CVE-2022-32190 CVE-2022-41717
====================================================================
1. Summary:

Red Hat OpenShift Virtualization release 4.13.0 is now available with
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

CNV 4.13 for RHEL 7 - x86_64
CNV 4.13 for RHEL 8 - aarch64, x86_64
CNV 4.13 for RHEL 9 - aarch64, x86_64

3. Description:

OpenShift Virtualization is Red Hat's virtualization solution designed for
Red Hat OpenShift Container Platform.

This advisory contains OpenShift Virtualization 4.13.0 RPMs.

Security Fix(es):

* golang: net/http: handle server errors after sending GOAWAY
(CVE-2022-27664)

* golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time
to parse complex tags (CVE-2022-32149)

* golang: net/url: JoinPath does not strip relative path components in all
circumstances (CVE-2022-32190)

* golang: net/http: excessive memory growth in a Go server accepting HTTP/2
requests (CVE-2022-41717)

* golang: math/big: decoding big.Float and big.Rat types can panic if the
encoded message is too short, potentially allowing a denial of service
(CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* 4.13.0 rpms (BZ#2124993)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2113814 - CVE-2022-32189 golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service
2124668 - CVE-2022-32190 golang: net/url: JoinPath does not strip relative path components in all circumstances
2124669 - CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
2124993 - 4.13.0 rpms
2134010 - CVE-2022-32149 golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags
2161274 - CVE-2022-41717 golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests

6. Package List:

CNV 4.13 for RHEL 7:

Source:
kubevirt-4.13.0-1469.el7.src.rpm

x86_64:
kubevirt-virtctl-4.13.0-1469.el7.x86_64.rpm
kubevirt-virtctl-redistributable-4.13.0-1469.el7.x86_64.rpm

CNV 4.13 for RHEL 8:

Source:
kubevirt-4.13.0-1469.el8.src.rpm

aarch64:
kubevirt-virtctl-4.13.0-1469.el8.aarch64.rpm
kubevirt-virtctl-redistributable-4.13.0-1469.el8.aarch64.rpm

x86_64:
kubevirt-virtctl-4.13.0-1469.el8.x86_64.rpm
kubevirt-virtctl-redistributable-4.13.0-1469.el8.x86_64.rpm

CNV 4.13 for RHEL 9:

Source:
kubevirt-4.13.0-1469.el9.src.rpm

aarch64:
kubevirt-virtctl-4.13.0-1469.el9.aarch64.rpm
kubevirt-virtctl-redistributable-4.13.0-1469.el9.aarch64.rpm

x86_64:
kubevirt-virtctl-4.13.0-1469.el9.x86_64.rpm
kubevirt-virtctl-redistributable-4.13.0-1469.el9.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-27664
https://access.redhat.com/security/cve/CVE-2022-32149
https://access.redhat.com/security/cve/CVE-2022-32189
https://access.redhat.com/security/cve/CVE-2022-32190
https://access.redhat.com/security/cve/CVE-2022-41717
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBZGW9TtzjgjWX9erEAQhH+Q/8DUbYSySNBJrRLT4Ff4xMDMkYQtw6DAmC
B0i6q6Zq/StXv7S+SfSW6qz5N46HGfF6qnAJGcldd/WSVUoaQZQ/SXK2dcgsNgoC
nIPRwfVHgs4Eb/cXfFxbW86imt/mPNnwftYlM+HIIyS+rdNCLzC+qmTHja+WhdAq
7NJwlyi2UqWd4DvB00URauw2wojpLDyO0EQQMFvKL0Vhjv3OC4s52xbFZ82Eyuzd
aQH54HcucJA9UAR+/9JZ3MP2kdqLgPZaeR4GvP9lM+0EdH7IgadCIp3lAxpmIbx5
hyXohGcdfwqP5sOGE8SCLpZUI354qG7nyT5VwO6xTXdXSOUYOQzDcZo8IM8IYno9
xIij1nrBwRtQ+z1HOdWIkQJz6kIZkAn/Rc114pphaQ+K1ltuPBVWG9xfgmUsAoZN
vCvLS63OnotY7VX3kuV0BaN7GxJw5A6rHNaEVHwEEPW94+r6D9DP7yTCVwK3whli
FNXNORe/LducK4Okn87frUpIWka9YuPMGNZC0cdltJ7oEZYMPoM0lCrU06R0y3eZ
HNG2hWhArHEaJWrZRo58qCkvRItFjO5yX6FoBsRn89xdkTH5J41xCMRrJVp0lF4S
xbKtoTmBhpIfeBuPMTDFGYMmSjXa/9+qbflAoDBRNU1Otl3NsVb3FnvtR/zDH/l4
rK77VXB2N2k=rj49
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce