what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2023-4421-01

Red Hat Security Advisory 2023-4421-01
Posted Aug 2, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-4421-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization 4.12.5 images.

tags | advisory
systems | linux, redhat
advisories | CVE-2020-24736, CVE-2022-41723, CVE-2022-4304, CVE-2023-0215, CVE-2023-0286, CVE-2023-1667, CVE-2023-2283, CVE-2023-24329, CVE-2023-24540, CVE-2023-26604, CVE-2023-2828, CVE-2023-3089
SHA-256 | db79e46b0eba3e1a78e180a54c5653048a4f2e53759b8bc14de7603ad8f84236

Red Hat Security Advisory 2023-4421-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: OpenShift Virtualization 4.12.5 security and bug fix update
Advisory ID: RHSA-2023:4421-01
Product: OpenShift Virtualization
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4421
Issue date: 2023-08-01
CVE Names: CVE-2020-24736 CVE-2022-4304 CVE-2022-41723
CVE-2023-0215 CVE-2023-0286 CVE-2023-1667
CVE-2023-2283 CVE-2023-2828 CVE-2023-3089
CVE-2023-24329 CVE-2023-24540 CVE-2023-26604
=====================================================================

1. Summary:

Red Hat OpenShift Virtualization release 4.12.5 is now available with
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

OpenShift Virtualization is Red Hat's virtualization solution designed for
Red Hat OpenShift Container Platform.

This advisory contains OpenShift Virtualization 4.12.5 images.

Security Fix(es):

* openshift: OCP & FIPS mode (CVE-2023-3089)

* golang: html/template: improper handling of JavaScript whitespace
(CVE-2023-24540)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* [4.12] must-gather doesn't collect ruletebles (BZ#2208641)

* nft rules are not collected if the VMs are running in the node where
must-gather is running (BZ#2214454)

* [cnv-4.12] kubevirt should allow setting cluster-wide virt-launcher
runtimeclass (BZ#2217913)

* USB-redirection regression (BZ#2221222)

3. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2027959 - [RFE] virt-launcher pod of Windows VM stuck in terminating state, no button in the UI to force power off
2182056 - Cloned VM should not use the same PVC of the source VM
2196027 - CVE-2023-24540 golang: html/template: improper handling of JavaScript whitespace
2208641 - [4.12] must-gather doesn't collect ruletebles
2209318 - [4.12.z] VM connected to a VLAN is also receiving packets from VLAN 1
2209848 - OpenShift Virtualization Overview page shows no metrics for "All Projects"
2212085 - CVE-2023-3089 openshift: OCP & FIPS mode
2214454 - nft rules are not collected if the VMs are running in the node where must-gather is running
2216447 - must-gather: Multiple empty files under vms/<vm-name> if the VM was live migrated
2216449 - must-gather is using unavailable brctl command
2217913 - [cnv-4.12] kubevirt should allow setting cluster-wide virt-launcher runtimeclass
2220843 - [4.12]Missing StorageProfile defaults for IBM and AWS EFS CSI provisioners
2221222 - USB-redirection regression
2222011 - [4.12]DataImportCron Garbage Collection can mistakenly delete latest PVC

5. References:

https://access.redhat.com/security/cve/CVE-2020-24736
https://access.redhat.com/security/cve/CVE-2022-4304
https://access.redhat.com/security/cve/CVE-2022-41723
https://access.redhat.com/security/cve/CVE-2023-0215
https://access.redhat.com/security/cve/CVE-2023-0286
https://access.redhat.com/security/cve/CVE-2023-1667
https://access.redhat.com/security/cve/CVE-2023-2283
https://access.redhat.com/security/cve/CVE-2023-2828
https://access.redhat.com/security/cve/CVE-2023-3089
https://access.redhat.com/security/cve/CVE-2023-24329
https://access.redhat.com/security/cve/CVE-2023-24540
https://access.redhat.com/security/cve/CVE-2023-26604
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/RHSB-2023-001

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJkyWkDAAoJENzjgjWX9erEf10P+gOCKsRV1UgO1ZTIPY7LSiTP
LQQ/HW3WnVup2ameg2z6O3+eUOJNWVCB9UWEvnlRiMMhLOhKhfqCjIYdBQkjaQM5
n6XYVEOYRj+LfGLh4JN81BLUat/9On6gDXx2LcNZvTwk4foJukYlv0wmtRPSsGJQ
9qCg63EjDhpTIFo3bMF1rjDgapcjL9tFNaO0HBp0PtcYiN47oBr6opIQ3kpS3cN4
cpZJGpeJBP3kPPYbpd5L/qJ2f6GJxHEztGQFChgzI9vK92RVJveHNYJaoqD3FqQr
j9+49nB/pmVqtgDX2Tjruh9h0F9aBy4c81Wl8YQ7zq5otBqwT4UKNR4WREzkMA6H
AG6DAFa/5i+akC6ENUgo/edxyEViwY7EcLhESxvBzOg4aHGIe7YawvnKdsItYoc1
8phvDLLkwkrwUjbYqZ4xCwMPPgeY1ASmUueFSNp/g6PPaeYGNlY9+iMxaiP4I49/
LfIM1hx5H2rodI3kbAsC8n+EcHQZRJ7AoWEXfhAELTU//gx2zoyaEly6660qaxLC
o8hV6L7YRiIgRYwKZLgd8NlVTfU+hXS62tL/A9MfxHdbgTZEo/FbR8sWfSaDKmbf
OdPQ8bMKDUZ4mMT0tsODTpeHTwlfXRDBkdr/Qz5XlcYp17YvxFMXJfUDghn1FY9j
1U9dFxlPP5VCadFQo/WJ
=SNKD
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close