RHBA-2022:7889 - Bug Fix Advisory

주제

The JBoss Web Server (JWS) Operator for OpenShift has been updated to provide a fix for an expat CVE and a libksba CVE.

설명

This erratum covers updates to the JWS Operator for OpenShift to fix expat CVE-2022-40674 and likbksba CVE-2022-3515.

솔루션

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

영향을 받는 제품

• Red Hat OpenShift Container Platform 4.10 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.9 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform for Power 4.10 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for Power 4.9 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.10 for RHEL 8 s390x
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.9 for RHEL 8 s390x

수정

• BZ - 2130769 - CVE-2022-40674 expat: a use-after-free in the doContent function in xmlparse.c
• JWS-2628 - Update JWS Openshift operator due to expat CVE
• JWS-2657 - Update JWS Openshift operator due to libksba CVE

CVE

• CVE-2020-35525
• CVE-2020-35527
• CVE-2022-2509
• CVE-2022-3515
• CVE-2022-37434
• CVE-2022-40674

참조

• https://access.redhat.com/errata/RHSA-2022:6878
• https://access.redhat.com/errata/RHSA-2022:7089