RHBA-2022:1319 - Bug Fix Advisory

Topic

This erratum updates the current JBoss Web Server 3.1 for OpenShift images to provide a fix for multiple Expat and OpenSSL CVEs.

Description

Red Hat xPaaS provides images for many of the Red Hat Middleware products that are available for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments.

The current JBoss Web Server 3.1 for OpenShift images have been updated to address the following Expat CVEs:

CVE-2021-45960, CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824, CVE-2022-22825, CVE-2022-22826, CVE-2022-22827, CVE-2022-23852, CVE-2022-25235, CVE-2022-25236, CVE-2022-25315

The current JBoss Web Server 3.1 for OpenShift images have been updated to address the following OpenSSL CVE:

CVE-2022-0778

Solution

To update to the latest JBoss Web Server for OpenShift image, perform the following steps to pull in the content:

1. On your master host(s), ensure that you are logged into the command line interface as a cluster administrator or user who has project administrator access to the global "openshift" project:

$ oc login -u system:admin

2. Depending on the Tomcat version, run either of the following commands to update the core JBoss Web Server 3.1 OpenShift image stream in the "openshift" project:

• For Tomcat 8:

To update the core JBoss Web Server 3.1 tomcat 8 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver31-tomcat8-openshift:1.4

• For Tomcat 7:

To update the core JBoss Web Server 3.1 tomcat 7 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver31-tomcat7-openshift:1.4

Affected Products

• Red Hat OpenShift Container Platform 4.9 for RHEL 7 x86_64
• Red Hat OpenShift Container Platform 4.8 for RHEL 7 x86_64
• Red Hat OpenShift Container Platform 3.11 x86_64

Fixes

• BZ - 2044451 - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
• BZ - 2044455 - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
• BZ - 2044457 - CVE-2022-22822 expat: Integer overflow in addBinding in xmlparse.c
• BZ - 2044464 - CVE-2022-22823 expat: Integer overflow in build_model in xmlparse.c
• BZ - 2044467 - CVE-2022-22824 expat: Integer overflow in defineAttribute in xmlparse.c
• BZ - 2044479 - CVE-2022-22825 expat: Integer overflow in lookup in xmlparse.c
• BZ - 2044484 - CVE-2022-22826 expat: Integer overflow in nextScaffoldPart in xmlparse.c
• BZ - 2044488 - CVE-2022-22827 expat: Integer overflow in storeAtts in xmlparse.c
• BZ - 2044613 - CVE-2022-23852 expat: Integer overflow in function XML_GetBuffer
• BZ - 2056363 - CVE-2022-25315 expat: Integer overflow in storeRawNames()
• BZ - 2056366 - CVE-2022-25235 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
• BZ - 2056370 - CVE-2022-25236 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
• CLOUD-4091 - [JWS31] Important - Multiple expat CVEs
• CLOUD-4092 - [JWS31] Important - openssl CVE-2022-0778

CVEs

• CVE-2021-45960
• CVE-2021-46143
• CVE-2022-0778
• CVE-2022-22822
• CVE-2022-22823
• CVE-2022-22824
• CVE-2022-22825
• CVE-2022-22826
• CVE-2022-22827
• CVE-2022-23852
• CVE-2022-25235
• CVE-2022-25236
• CVE-2022-25315

References

• https://access.redhat.com/errata/RHSA-2022:1069
• https://access.redhat.com/containers