RHBA-2023:3972 - Bug Fix Advisory

Topic

The JBoss Web Server (JWS) Operator for OpenShift has been updated to provide a fix for python CVE-2023-24329.

Description

This erratum covers updates to the JWS Operator for OpenShift to fix python CVE-2023-24329.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Container Platform 4.10 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.9 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform for Power 4.10 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for Power 4.9 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.10 for RHEL 8 s390x
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.9 for RHEL 8 s390x

Fixes

• BZ - 2173917 - CVE-2023-24329 python: urllib.parse url blocklisting bypass
• JWS-2989 - Update JWS Openshift operator due to python3 CVE

CVEs

• CVE-2022-36227
• CVE-2023-0361
• CVE-2023-24329
• CVE-2023-27535

References

• https://access.redhat.com/errata/RHSA-2023:3591