-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenStack Platform 16.2 (etcd) security update Advisory ID: RHSA-2022:6061-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2022:6061 Issue date: 2022-08-15 CVE Names: CVE-2022-21698 CVE-2022-30631 ==================================================================== 1. Summary: An update for etcd is now available for Red Hat OpenStack Platform 16.2 (Train). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 16.2 - ppc64le, x86_64 3. Description: The etcd packages provide a highly available key-value store for shared configuration. Security Fix(es): * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2045880 - CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter 2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read 6. Package List: Red Hat OpenStack Platform 16.2: Source: etcd-3.3.23-10.el8ost.src.rpm ppc64le: etcd-3.3.23-10.el8ost.ppc64le.rpm etcd-debuginfo-3.3.23-10.el8ost.ppc64le.rpm etcd-debugsource-3.3.23-10.el8ost.ppc64le.rpm x86_64: etcd-3.3.23-10.el8ost.x86_64.rpm etcd-debuginfo-3.3.23-10.el8ost.x86_64.rpm etcd-debugsource-3.3.23-10.el8ost.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-21698 https://access.redhat.com/security/cve/CVE-2022-30631 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYvo20tzjgjWX9erEAQiX3w/7BqJylR0wjzoTZyhtzLAo5EtOYCcoBmzH IhBuvxUmBgM8IvnqedPBGa17v5+7OsZvJKUqkZjfnIL9MFdrYSiaqHR1T4mS0Qsu Q830AYyFU2sTSa22AmR03Xhfr4e3WXi+gYnR9dPqxuRvr2gaVMZ0R150kQSr+ez1 ZQ+58lv2krhnUZK1qznyxDRUSauRqRgQvjNjhVipA5q3mCDu0FuJkyEa+65MIyP7 4yTXRspx4Uk2fCIhm+RNRJPZTIG2t9vuX1tjozsoi3x6yiYGTMKh+OBGB2w8QIig IOPZDlcbqh9/XZhpWo0sYLeBqHepOX3KE46q/40BhsjbOoKOdm7A4P81zxjNJ1lU BbsKSEjeVQtEXAmLM1j0RNxAMYBfJJWS1Cu4mB3/M6kI2+gB6BzoPiPiZDt/5QU0 loujArrUdeEnWNy65JJ9fVhKNf7iJ5NAf8GHE9AEPmwQSXSIuf5g5z8N1zHGF/7x O/uuHfx5XEBLkjMEpkSatxZ/RgMOvbKOQRMGuFMq621BOFsjsh7hyzeo3LJC5e1z 75j5cXzd0VVLsr19HrB7HoinAQZvFALf5Qw0Uqd1Abcr+wPaN32NPjb+WNMU987/ 1bocpSrFlbcycLN7CH1AfVR6XdNSctdzAbGv2AwLcuqsro5e5QEEPZSI1/yMLc9B KZvTwvCKViQÔ+p -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce