Red Hat Product Errata RHBA-2022:6077 - Bug Fix Advisory
Issued:
2022-08-16
Updated:
2022-08-16

RHBA-2022:6077 - Bug Fix Advisory

Synopsis

Update JBoss Web Server 5.6 for OpenShift images on UBI8 for openjdk CVEs

Type/Severity

Bug Fix Advisory

Topic

This erratum covers updates to the current Red Hat JBoss Web Server 5.6 for OpenShift UBI8 images to fix multiple java-11-openjdk and java-1.8.0-openjdk CVEs.

Description

Red Hat xPaaS provides images for many of the Red Hat Middleware products that are available for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments.

The current Red Hat JBoss Web Server 5.6 for OpenShift images have been updated to fix the following CVEs for java-11-openjdk and java-1.8.0-openjdk:

  • CVE-2022-34169
  • CVE-2022-21540
  • CVE-2022-21541

Solution

To update to the latest JBoss Web Server 5.6.2 for OpenShift image on UBI8, perform the following steps to pull in the content:

1. On your master host(s), ensure that you are logged in to the command line interface as a cluster administrator or user who has project administrator access to the global "openshift" project:

$ oc login -u system:admin

2. Run the following command to import the templates:

$ for resource in jws56-openjdk11-tomcat9-ubi8-basic-s2i.json \ jws56-openjdk11-tomcat9-ubi8-https-s2i.json \ jws56-openjdk11-tomcat9-ubi8-image-stream.json \ jws56-openjdk8-tomcat9-ubi8-basic-s2i.json \ jws56-openjdk8-tomcat9-ubi8-https-s2i.json \ jws56-openjdk8-tomcat9-ubi8-image-stream.json do oc replace -n openshift --force -f \ https://raw.githubusercontent.com/jboss-container-images/jboss-webserver-5-openshift-image/jws56el8-v5.6.2/templates/${resource} done

3. Depending on the OpenJDK version, run either of the following commands to update the core JBoss Web Server 5.6 tomcat 9 OpenShift image stream in the "openshift" project:

  • For OpenJDK 8:

To update the core JBoss Web Server 5.6 tomcat 9 with OpenJDK 8 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver56-openjdk8-tomcat9-openshift-ubi8:5.6.2

  • For OpenJDK 11:

To update the core JBoss Web Server 5.6 tomcat 9 with OpenJDK 11 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver56-openjdk11-tomcat9-openshift-ubi8:5.6.2

Affected Products

  • Red Hat OpenShift Container Platform 4.10 for RHEL 8 x86_64
  • Red Hat OpenShift Container Platform 4.9 for RHEL 8 x86_64
  • Red Hat OpenShift Container Platform for Power 4.10 for RHEL 8 ppc64le
  • Red Hat OpenShift Container Platform for Power 4.9 for RHEL 8 ppc64le
  • Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.10 for RHEL 8 s390x
  • Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.9 for RHEL 8 s390x

Fixes

  • BZ - 2108540 - CVE-2022-21540 OpenJDK: class compilation issue (Hotspot, 8281859)
  • BZ - 2108543 - CVE-2022-21541 OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866)
  • BZ - 2108554 - CVE-2022-34169 OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407)
  • CLOUD-4117 - [JWS56] Important - java-11-openjdk multiple CVEs
  • CLOUD-4118 - [JWS56] Important - java-1.8.0-openjdk multiple CVEs

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.