RHBA-2023:4992 - Bug Fix Advisory

Topic

The JBoss Web Server (JWS) Operator for OpenShift has been updated to provide a fix for subscription-manager CVE-2023-3899.

Description

This erratum covers updates to the JWS Operator for OpenShift to fix subscription-manager CVE-2023-3899.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Container Platform 4.11 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.10 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform for Power 4.10 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.10 for RHEL 8 s390x

Fixes

• BZ - 2225407 - CVE-2023-3899 subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration
• JWS-3051 - Update JWS Openshift operator due to subscription-manager CVE

CVEs

• CVE-2020-24736
• CVE-2023-1667
• CVE-2023-2283
• CVE-2023-2602
• CVE-2023-2603
• CVE-2023-3899
• CVE-2023-27536
• CVE-2023-28321
• CVE-2023-28484
• CVE-2023-29469
• CVE-2023-32681
• CVE-2023-34969

References

• https://access.redhat.com/errata/RHSA-2023:4706