-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: OpenShift sandboxed containers 1.3.1 security fix and bug fix update Advisory ID: RHSA-2022:7058-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2022:7058 Issue date: 2022-10-19 CVE Names: CVE-2015-20107 CVE-2022-0391 CVE-2022-1292 CVE-2022-1586 CVE-2022-1785 CVE-2022-1897 CVE-2022-1927 CVE-2022-2068 CVE-2022-2097 CVE-2022-2832 CVE-2022-24675 CVE-2022-29154 CVE-2022-30632 CVE-2022-32206 CVE-2022-32208 CVE-2022-34903 CVE-2022-40674 ==================================================================== 1. Summary: OpenShift sandboxed containers 1.3.1 is now available. 2. Description: OpenShift sandboxed containers support for OpenShift Container Platform provides users with built-in support for running Kata containers as an additional, optional runtime. This advisory contains an update for OpenShift sandboxed containers with security fixes and a bug fix. Space precludes documenting all of the updates to OpenShift sandboxed containers in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.openshift.com/container-platform/4.11/sandboxed_containers/sandboxed-containers-release-notes.html 3. Solution: Before applying this update, ensure all previously released errata relevant to your system have been applied. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://docs.openshift.com/container-platform/latest/sandboxed_containers/upgrade-sandboxed-containers.html 4. Bugs fixed (https://bugzilla.redhat.com/): 2077688 - CVE-2022-24675 golang: encoding/pem: fix stack overflow in Decode 2107386 - CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob 2118556 - CVE-2022-2832 blender: Null pointer reference in blender thumbnail extractor 5. JIRA issues fixed (https://issues.jboss.org/): KATA-1751 - CVE-2022-24675 osc-operator-container: golang: encoding/pem: fix stack overflow in Decode [rhosc-1] KATA-1752 - CVE-2022-28327 osc-operator-container: golang: crypto/elliptic: panic caused by oversized scalar [rhosc-1] KATA-1754 - OSC Pod security issue in 4.12 prevents subscribing to operator KATA-1758 - CVE-2022-30632 osc-operator-container: golang: path/filepath: stack exhaustion in Glob [rhosc-1] 6. References: https://access.redhat.com/security/cve/CVE-2015-20107 https://access.redhat.com/security/cve/CVE-2022-0391 https://access.redhat.com/security/cve/CVE-2022-1292 https://access.redhat.com/security/cve/CVE-2022-1586 https://access.redhat.com/security/cve/CVE-2022-1785 https://access.redhat.com/security/cve/CVE-2022-1897 https://access.redhat.com/security/cve/CVE-2022-1927 https://access.redhat.com/security/cve/CVE-2022-2068 https://access.redhat.com/security/cve/CVE-2022-2097 https://access.redhat.com/security/cve/CVE-2022-2832 https://access.redhat.com/security/cve/CVE-2022-24675 https://access.redhat.com/security/cve/CVE-2022-29154 https://access.redhat.com/security/cve/CVE-2022-30632 https://access.redhat.com/security/cve/CVE-2022-32206 https://access.redhat.com/security/cve/CVE-2022-32208 https://access.redhat.com/security/cve/CVE-2022-34903 https://access.redhat.com/security/cve/CVE-2022-40674 https://access.redhat.com/security/updates/classification/#moderate 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY1C5WdzjgjWX9erEAQgJMw//UotXcQCJjQq9U/dMEE92E+gMGXIkLA0E r7WbJOwUYeokObhxD9T5Xq3/bXxRc1o/IGXIiL+0pxQSoG/JtjtI+DB9yUDxMdBU cNIu+H/o5aN0CPgIuYppi/UT1e3GUwkhMK310Ic8MFP/FKBzEu3sJmbLf3n1FRVp mpd+J08ksUo8NVKwqglyHgRyoDGOkzNd3jqo0q8PU07NmVWNcmQMmwE85/nEm4Cq PENRUyIKBQB7IhVdBhEy0RGCKqihnre4bwIoi3DULUfthnkuUEciBkTCNdEeRBmZ 5wda1tj1vjbaLByeaEPla6+e48JcudmbL8G/ppacKUnVBD6p4qtW9LzdnOxRlrI2 /MYM4kV3Z4gDTBZPEKVdgdMTDcHpjVB0d6IM+9yMSCjKMj3ihjeV/FYIxeo8WC0E Gdie+Kvd+1R/dRUdMh/FlUuk3dZjH6Xz3b7fkuIW1IVqC3xwawaT0MrmTBzqcyqu PYcIZmKUwglMn/fKOBlE4ynzirGX+tvVkP7Tu8nVm94YnWpZw4eDTY6E4WQqS3a5 tgiKgqgey5cK6fLg8yQyPdSJfGzwAMiylCLVwSH8CMXBLvVxbRolBPDkz49ArxET 36Pt3w7vkKUCPtSvk/1p36KZ/yHviYt4E2etRtwcGLvzGIqtu6vaq9NAWS+kcMbx dW4UeWt2Fow=N7WL -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce