RHBA-2023:1825 - Bug Fix Advisory

Topic

Submariner 0.14.3 packages that contain security fixes, bug fixes, and various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.7

Description

Submariner enables direct networking between pods and services on different Kubernetes clusters that are either on-premises or in the cloud.

For more information about Submariner, see the Submariner open source community website at: https://submariner.io/.

This advisory contains bug fixes and enhancements to the Submariner container images.

Security fixes in base image:

• CVE-2023-0286: openssl: X.400 address type confusion in X.509 GeneralName

Security

• CVE-2022-4304: openssl: timing attack in RSA Decryption implementation
• CVE-2023-0215: openssl: use-after-free following BIO_new_NDEF
• CVE-2022-4450: openssl: double free after calling PEM_read_bio_ex
• CVE-2023-23916: curl: HTTP multi-header compression denial of service

Jira issues addressed:

• ACM-3751: ClusterIP service resolved before ready
• ACM-4280: Support image-override in subctl diagnose command
• ACM-4286: Build Submariner 0.14.3

Solution

For details on how to install Submariner, refer to:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.7/html/add-ons/add-ons-overview#deploying-submariner-console

and

https://submariner.io/getting-started/

Affected Products

• Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 8 x86_64

Fixes

• BZ - 2164440 - CVE-2023-0286 openssl: X.400 address type confusion in X.509 GeneralName
• BZ - 2164487 - CVE-2022-4304 openssl: timing attack in RSA Decryption implementation
• BZ - 2164492 - CVE-2023-0215 openssl: use-after-free following BIO_new_NDEF
• BZ - 2164494 - CVE-2022-4450 openssl: double free after calling PEM_read_bio_ex
• BZ - 2167815 - CVE-2023-23916 curl: HTTP multi-header compression denial of service
• ACM-3751 - [Submariner 0.14.3] ClusterIP service resolved before ready
• ACM-4280 - [Submariner 0.14.3] Support image-override in subctl diagnose command
• ACM-4286 - [ACM 2.7.3] Build Submariner 0.14.3

CVEs

• CVE-2023-23916

References

(none)