RHBA-2023:0011 - Bug Fix Advisory

Topic

This erratum covers updates to the current Red Hat JBoss Web Server 3.1 for OpenShift images to fix krb5 CVE-2022-42898.

Description

Red Hat xPaaS provides images for many of the Red Hat Middleware products that are available for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments.

The current JBoss Web Server 3.1 for OpenShift images have been updated to fix krb5 CVE-2022-42898.

Solution

To update to the latest JBoss Web Server for OpenShift image, perform the following steps to pull in the content:

1. On your master host(s), ensure that you are logged into the command line interface as a cluster administrator or user who has project administrator access to the global "openshift" project:

$ oc login -u system:admin

2. Depending on the Tomcat version, run either of the following commands to update the core JBoss Web Server 3.1 OpenShift image stream in the "openshift" project:

• For Tomcat 8:

To update the core JBoss Web Server 3.1 tomcat 8 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver31-tomcat8-openshift:1.4

• For Tomcat 7:

To update the core JBoss Web Server 3.1 tomcat 7 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver31-tomcat7-openshift:1.4

Affected Products

• Red Hat OpenShift Container Platform 4.9 for RHEL 7 x86_64
• Red Hat OpenShift Container Platform 4.8 for RHEL 7 x86_64
• Red Hat OpenShift Container Platform 3.11 x86_64

Fixes

• BZ - 2140960 - CVE-2022-42898 krb5: integer overflow vulnerabilities in PAC parsing
• CLOUD-4151 - [JWS31] Important - krb5: integer overflow vulnerabilities in PAC parsing (CVE-2022-42898)

CVEs

• CVE-2022-42898

References

• https://access.redhat.com/errata/RHSA-2022:8640