- Issued:
- 2023-10-17
- Updated:
- 2023-10-17
RHBA-2023:5798 - Bug Fix Advisory
Synopsis
Update the JWS Operator for OpenShift to fix glibc CVEs
Type/Severity
Bug Fix Advisory
Topic
The JBoss Web Server (JWS) Operator for OpenShift has been updated to provide a fix for multiple glibc CVEs.
Description
This erratum covers updates to the JWS Operator for OpenShift to fix the following glibc CVEs:
- CVE-2023-4911
- CVE-2023-4527
- CVE-2023-4806
- CVE-2023-4813
Solution
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
Affected Products
- Red Hat OpenShift Container Platform 4.11 for RHEL 8 x86_64
- Red Hat OpenShift Container Platform 4.10 for RHEL 8 x86_64
- Red Hat OpenShift Container Platform for Power 4.10 for RHEL 8 ppc64le
- Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.10 for RHEL 8 s390x
Fixes
- BZ - 2234712 - CVE-2023-4527 glibc: Stack read overflow in getaddrinfo in no-aaaa mode
- BZ - 2237782 - CVE-2023-4806 glibc: potential use-after-free in getaddrinfo()
- BZ - 2237798 - CVE-2023-4813 glibc: potential use-after-free in gaih_inet()
- BZ - 2238352 - CVE-2023-4911 glibc: buffer overflow in ld.so leading to privilege escalation
- JWS-3101 - Update JWS Openshift operator due to glibc CVEs
ppc64le
jboss-webserver-5/jws5-operator-bundle@sha256:18853259e4e011b2d088c5385df6c3bdb01f9bbeceb7c8f0fe4ced81bd1b8b24 |
jboss-webserver-5/jws5-rhel8-operator@sha256:0b17e04dee2d334554af9769eb51df13931afeb4425e980f67eeeeb1d15945df |
s390x
jboss-webserver-5/jws5-operator-bundle@sha256:97cbb27a4f0ae86d9ecaeeeaa642741d4706b72b9a00e5e2a7eac5e44c33f866 |
jboss-webserver-5/jws5-rhel8-operator@sha256:d6ffcde94c9b0810c6546e4fbf5d1711516c06a92ffbe2f0340f1d4fc222753e |
x86_64
jboss-webserver-5/jws5-operator-bundle@sha256:f25bddfa6bffa7b573808d32b87cd08e500bd8ff0bb93a7e4603261a17779436 |
jboss-webserver-5/jws5-rhel8-operator@sha256:54fe86f781802de6d8f477ad7ae42aa7e52d22e43f7125d9f23ab5de02a5e933 |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.