RHBA-2023:1850 - Bug Fix Advisory

Topic

Submariner 0.13 packages that fix various bugs that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.6.

Description

Submariner enables direct networking between pods and services on different Kubernetes clusters that are either on-premises or in the cloud.

For more information about Submariner, see the Submariner open source community website at: https://submariner.io/.

This advisory contains bug fixes and enhancements to the Submariner container images.

Security fixes:

• CVE-2023-0286: openssl: X.400 address type confusion in X.509 GeneralName
• CVE-2022-4304: openssl: timing attack in RSA Decryption implementation
• CVE-2023-0215: openssl: use-after-free following BIO_new_NDEF
• CVE-2022-4450: openssl: double free after calling PEM_read_bio_ex

Jira issues addressed:

• ACM-2226: Build Submariner 0.13.3
• ACM-2435: Verify Submariner with OCP 4.12
• ACM-2821: Submariner does not support cluster "kube-proxy ipvs mode"

Solution

For details on how to install Submariner, refer to:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#submariner-deploy-console

and

https://submariner.io/getting-started/

Affected Products

• Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 8 x86_64

Fixes

• BZ - 2164440 - CVE-2023-0286 openssl: X.400 address type confusion in X.509 GeneralName
• BZ - 2164487 - CVE-2022-4304 openssl: timing attack in RSA Decryption implementation
• BZ - 2164492 - CVE-2023-0215 openssl: use-after-free following BIO_new_NDEF
• BZ - 2164494 - CVE-2022-4450 openssl: double free after calling PEM_read_bio_ex
• ACM-3430 - [ACM 2.6.5] Submariner: OpenShift 4.12 on Azure platform unable to create a gateway node
• ACM-3605 - [ACM 2.6.5] Submariner Gateway was not created for cluster-set with 19 chars
• ACM-3734 - Build Submariner 0.13.4

CVEs

• CVE-2020-10735
• CVE-2021-28861
• CVE-2022-4337
• CVE-2022-4338
• CVE-2022-4415
• CVE-2022-40897
• CVE-2022-45061
• CVE-2022-47629
• CVE-2022-48303
• CVE-2023-23916

References

(none)