Red Hat Product Errata RHSA-2021:3926 - Security Advisory
Issued:
2021-10-27
Updated:
2021-10-27

RHSA-2021:3926 - Security Advisory

Synopsis

Moderate: OpenShift Container Platform 4.8.17 security and bug fix update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Red Hat OpenShift Container Platform release 4.8.17 is now available with
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.17. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2021:3927

Security Fix(es):

  • coreos-installer: incorrect signature verification on gzip-compressed install images (CVE-2021-20319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.8 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-between-minor.html#understanding-upgrade-channels_updating-cluster-between-minor

Solution

For OpenShift Container Platform 4.8 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html

Affected Products

  • Red Hat OpenShift Container Platform 4.8 for RHEL 8 x86_64
  • Red Hat OpenShift Container Platform 4.8 for RHEL 7 x86_64
  • Red Hat OpenShift Container Platform for Power 4.8 for RHEL 8 ppc64le
  • Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.8 for RHEL 8 s390x

Fixes

  • BZ - 2011862 - CVE-2021-20319 coreos-installer: incorrect signature verification on gzip-compressed install images
  • BZ - 2015758 - Placeholder bug for OCP 4.8.0 rpm release

Red Hat OpenShift Container Platform 4.8 for RHEL 8

SRPM
coreos-installer-0.9.0-7.rhaos4.8.el8.src.rpm SHA-256: aa730f8e93bc426e68d7d805ff40dd057c498fbc6604e5cac3f1b8dda0e861ab
cri-o-1.21.3-8.rhaos4.8.git7415a53.el8.src.rpm SHA-256: b420afbe801e6678ca0258b81c593a963d5dab098a2606b98dbbd2861e3b13b9
openshift-4.8.0-202110152028.p0.git.6438632.assembly.stream.el8.src.rpm SHA-256: f175a151e001fb34025b6be264819f5d31a582e9de658ace53666724de90bb7b
openshift-kuryr-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.src.rpm SHA-256: cee7dcef1ea0b7aacc0e3cdc00f7d436df9984dc3799eae4640d938453c8aef6
ovn2.13-20.12.0-183.el8fdp.src.rpm SHA-256: 4e57c4935fafa82996c4f24392192aab05fba7d5fcad33f0021d159eed2c8c95
x86_64
coreos-installer-0.9.0-7.rhaos4.8.el8.x86_64.rpm SHA-256: f39340e04ce46face0d6772e85198465260b8c6ec8c5f37acf0199dad517a89f
coreos-installer-bootinfra-debuginfo-0.9.0-7.rhaos4.8.el8.x86_64.rpm SHA-256: 79b2566ad2333f3cde0f5a21f9b21fbb4520dad0b331cf65b73674d1e4cb7576
coreos-installer-debuginfo-0.9.0-7.rhaos4.8.el8.x86_64.rpm SHA-256: 0cc767fae293ecce581ced1de0f87e3bef98ac41d0248fe69eff18102e7d59e4
coreos-installer-debugsource-0.9.0-7.rhaos4.8.el8.x86_64.rpm SHA-256: 46d26a71cba7971ee80d141b02e727c16a0da7b593e21f2a988717d450df17c5
cri-o-1.21.3-8.rhaos4.8.git7415a53.el8.x86_64.rpm SHA-256: 37a19ae1d3942929fb29128628383c097f8bf5eae03253c847f7d7d2b517b444
cri-o-debuginfo-1.21.3-8.rhaos4.8.git7415a53.el8.x86_64.rpm SHA-256: 039d7c7afaaa69424ed590cd723054fb9a5a58910078a4a8c0c3e82fa499b28a
cri-o-debugsource-1.21.3-8.rhaos4.8.git7415a53.el8.x86_64.rpm SHA-256: 0201b52f761cfcd9b899e25163235b6658ecd4f244fd7b7473be7b2a7d9d4ac8
openshift-hyperkube-4.8.0-202110152028.p0.git.6438632.assembly.stream.el8.x86_64.rpm SHA-256: 8555de2626ad1003e80cdf2fd68377bcbf450c7ce99046c9e25cdb28f6c0f022
openshift-kuryr-cni-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.noarch.rpm SHA-256: df01405652ee7f474240c3b9606d8886c1807b1bc5197e09a93fef77c86a6712
openshift-kuryr-common-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.noarch.rpm SHA-256: 64efa502bcdef8b58c9e31367e796c8765d54a33f9201d9d592150205a479753
openshift-kuryr-controller-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.noarch.rpm SHA-256: de8f4631c4c589bf4389f503fba258dbe6d1e13582c41f9994343aaef4fda35d
ovn2.13-20.12.0-183.el8fdp.x86_64.rpm SHA-256: 52fde764d9fe646c5a4607d789ffc84bff708eddc51b1891401525b332d63038
ovn2.13-central-20.12.0-183.el8fdp.x86_64.rpm SHA-256: a37aab8ea5f3231b0ddbe9c6160ab74ac5e4b9480b5307b591da5c59977dd94b
ovn2.13-central-debuginfo-20.12.0-183.el8fdp.x86_64.rpm SHA-256: 5887d6b0b0af4a20abeb77272a385df41c72cd27339015275c04d18329564f30
ovn2.13-debuginfo-20.12.0-183.el8fdp.x86_64.rpm SHA-256: 7382165aaaf116553756712d2442dbc381ab97ce725aa0778dfbd38f9cc2e89b
ovn2.13-debugsource-20.12.0-183.el8fdp.x86_64.rpm SHA-256: 11fe49937c2da895a17b523ec6c00e4575bc79e89332b57decbea97b12691d64
ovn2.13-host-20.12.0-183.el8fdp.x86_64.rpm SHA-256: 94ce380d9080642d1679c29c39f83cb5dc8b1701ea01ed60eb69741c0b16e7cb
ovn2.13-host-debuginfo-20.12.0-183.el8fdp.x86_64.rpm SHA-256: 995a1c0bec4a61bd211bf3cc77b0a4577a2c6345edfaacdeeb102f35930c1874
ovn2.13-vtep-20.12.0-183.el8fdp.x86_64.rpm SHA-256: d6d363b44d8bf46370b324b86b91f1b5b466924209f922008c609331ead66ae1
ovn2.13-vtep-debuginfo-20.12.0-183.el8fdp.x86_64.rpm SHA-256: 50398b3a92cb667e0a77bf607e38717302fef3d1b0b67f3e720d99f1a7dc509b
python3-kuryr-kubernetes-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.noarch.rpm SHA-256: a77f9b75de6c8fc7875e1eeb92042288015dbbf891fcdf3ab18a24c736c9e399

Red Hat OpenShift Container Platform 4.8 for RHEL 7

SRPM
cri-o-1.21.3-8.rhaos4.8.git7415a53.el7.src.rpm SHA-256: d73c057f9df691006dd417aea572eff89d0777888c6dd81daf82748532e5a2e3
openshift-4.8.0-202110152028.p0.git.6438632.assembly.stream.el7.src.rpm SHA-256: a69f098e558367c3dd4440293c8b5f3dfda3ab4fdd81081519f3a750f0100ac0
x86_64
cri-o-1.21.3-8.rhaos4.8.git7415a53.el7.x86_64.rpm SHA-256: 23b3e0cd11e7dcf233d22eee48b345b7c4b574173d958a89a706cf29d4c40e96
cri-o-debuginfo-1.21.3-8.rhaos4.8.git7415a53.el7.x86_64.rpm SHA-256: f05c85301520aacd3eeb1e4814365a5eaa5f740256963548c3fae5643119e367
openshift-hyperkube-4.8.0-202110152028.p0.git.6438632.assembly.stream.el7.x86_64.rpm SHA-256: 63a60a8ef34772d691ead611c45b65a4322d48a3beaeb6b334ba72384757e831

Red Hat OpenShift Container Platform for Power 4.8 for RHEL 8

SRPM
coreos-installer-0.9.0-7.rhaos4.8.el8.src.rpm SHA-256: aa730f8e93bc426e68d7d805ff40dd057c498fbc6604e5cac3f1b8dda0e861ab
cri-o-1.21.3-8.rhaos4.8.git7415a53.el8.src.rpm SHA-256: b420afbe801e6678ca0258b81c593a963d5dab098a2606b98dbbd2861e3b13b9
openshift-4.8.0-202110152028.p0.git.6438632.assembly.stream.el8.src.rpm SHA-256: f175a151e001fb34025b6be264819f5d31a582e9de658ace53666724de90bb7b
openshift-kuryr-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.src.rpm SHA-256: cee7dcef1ea0b7aacc0e3cdc00f7d436df9984dc3799eae4640d938453c8aef6
ovn2.13-20.12.0-183.el8fdp.src.rpm SHA-256: 4e57c4935fafa82996c4f24392192aab05fba7d5fcad33f0021d159eed2c8c95
ppc64le
coreos-installer-0.9.0-7.rhaos4.8.el8.ppc64le.rpm SHA-256: 59798af5daa2e028999e7208721540865eb953370747a93d0c87f873424771c4
coreos-installer-bootinfra-0.9.0-7.rhaos4.8.el8.ppc64le.rpm SHA-256: 1194920e05e21971c9f8b64c3a6e51ddf3fd163dc05c95d1066ebc2277c347f5
coreos-installer-bootinfra-debuginfo-0.9.0-7.rhaos4.8.el8.ppc64le.rpm SHA-256: 709ba7f51f95b5fb4cfd95b6de469d15c469c5d45a15315eff84d5d625fa93b0
coreos-installer-debuginfo-0.9.0-7.rhaos4.8.el8.ppc64le.rpm SHA-256: f4d2b40683adf83984f7a693d6079beed2700b8c8a13a8b59cc57e1c05bfe9e3
coreos-installer-debugsource-0.9.0-7.rhaos4.8.el8.ppc64le.rpm SHA-256: 547298a249ce84afb26db6725fa3c6643ae50f8cab1ea71e0981f824cb5de776
cri-o-1.21.3-8.rhaos4.8.git7415a53.el8.ppc64le.rpm SHA-256: cf93a58d3004132dbd2101eb1b28d0eeb1c78576eb8e31bbba01f4c7f1c00b0b
cri-o-debuginfo-1.21.3-8.rhaos4.8.git7415a53.el8.ppc64le.rpm SHA-256: 002f2997393056104763ac486bad4a623df03ef8a43d36446bd4bdcd4d438ba3
cri-o-debugsource-1.21.3-8.rhaos4.8.git7415a53.el8.ppc64le.rpm SHA-256: 51ae6cde0f886a8904db67eb5fa445cb26900fd9610598344c2d41435d0d8884
openshift-hyperkube-4.8.0-202110152028.p0.git.6438632.assembly.stream.el8.ppc64le.rpm SHA-256: 14c8572e58729452dfd4abbc68d51de4fba82918422fb11cc2df1205ce942390
openshift-kuryr-cni-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.noarch.rpm SHA-256: df01405652ee7f474240c3b9606d8886c1807b1bc5197e09a93fef77c86a6712
openshift-kuryr-common-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.noarch.rpm SHA-256: 64efa502bcdef8b58c9e31367e796c8765d54a33f9201d9d592150205a479753
openshift-kuryr-controller-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.noarch.rpm SHA-256: de8f4631c4c589bf4389f503fba258dbe6d1e13582c41f9994343aaef4fda35d
ovn2.13-20.12.0-183.el8fdp.ppc64le.rpm SHA-256: 7cc2e2b06d62430ea2c559a06a32e2ef8c406eaf80994769fa27d9e2a92c48f3
ovn2.13-central-20.12.0-183.el8fdp.ppc64le.rpm SHA-256: 4e31dc6dd1b6e4ea74c58c534c181075ec8c575f037cfc237b0d437e8e39f3dd
ovn2.13-central-debuginfo-20.12.0-183.el8fdp.ppc64le.rpm SHA-256: db0e1f5f1b39501a0d9eb5969e56f8053cb19abccd3d0c3cd5133368fc944a55
ovn2.13-debuginfo-20.12.0-183.el8fdp.ppc64le.rpm SHA-256: 5e73494c22ef19bfc041dd20614f5ea52fe63737bc535ecb7915813ae6f4bc38
ovn2.13-debugsource-20.12.0-183.el8fdp.ppc64le.rpm SHA-256: 5efe11f5994e662770f7fcfa7b2f1271c89085252fa83536f3e85a447912c44b
ovn2.13-host-20.12.0-183.el8fdp.ppc64le.rpm SHA-256: 9e7a532f3f1d96447707ee59329b4a52b0d31bb6c728335bbfa9c259e65deff3
ovn2.13-host-debuginfo-20.12.0-183.el8fdp.ppc64le.rpm SHA-256: c2f1eafee5e1bb2c1cc31c2803df80af927ca7531e9f1241a122f170745dc4b6
ovn2.13-vtep-20.12.0-183.el8fdp.ppc64le.rpm SHA-256: 148db645a9b28999ffae50e3c5efb7d770c7efcefa4237e3afd51d354e236ce0
ovn2.13-vtep-debuginfo-20.12.0-183.el8fdp.ppc64le.rpm SHA-256: 312cdf362f995075949c436564ea126297ba6c60f650c2d90ad0e2f6d91addc6
python3-kuryr-kubernetes-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.noarch.rpm SHA-256: a77f9b75de6c8fc7875e1eeb92042288015dbbf891fcdf3ab18a24c736c9e399

Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.8 for RHEL 8

SRPM
coreos-installer-0.9.0-7.rhaos4.8.el8.src.rpm SHA-256: aa730f8e93bc426e68d7d805ff40dd057c498fbc6604e5cac3f1b8dda0e861ab
cri-o-1.21.3-8.rhaos4.8.git7415a53.el8.src.rpm SHA-256: b420afbe801e6678ca0258b81c593a963d5dab098a2606b98dbbd2861e3b13b9
openshift-4.8.0-202110152028.p0.git.6438632.assembly.stream.el8.src.rpm SHA-256: f175a151e001fb34025b6be264819f5d31a582e9de658ace53666724de90bb7b
openshift-kuryr-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.src.rpm SHA-256: cee7dcef1ea0b7aacc0e3cdc00f7d436df9984dc3799eae4640d938453c8aef6
ovn2.13-20.12.0-183.el8fdp.src.rpm SHA-256: 4e57c4935fafa82996c4f24392192aab05fba7d5fcad33f0021d159eed2c8c95
s390x
coreos-installer-0.9.0-7.rhaos4.8.el8.s390x.rpm SHA-256: bd8274eaf2957ed4d6664db52273f3b86c280094a7c37f2a4455af776168346a
coreos-installer-bootinfra-0.9.0-7.rhaos4.8.el8.s390x.rpm SHA-256: d478126c78dfc9f8120558dfffdc57104636f16c12046c6fa7cac6c1ef69d63f
coreos-installer-bootinfra-debuginfo-0.9.0-7.rhaos4.8.el8.s390x.rpm SHA-256: fd6a74f8d9eec89d6e1db9377fd92be6e2f2d22701fb152fe125094047a9632d
coreos-installer-debuginfo-0.9.0-7.rhaos4.8.el8.s390x.rpm SHA-256: 8c174afcc8d08504a54c00a5dbee62af278c8f3997aafd43ac56ca25ce108ae9
coreos-installer-debugsource-0.9.0-7.rhaos4.8.el8.s390x.rpm SHA-256: 62f8dccf9d168be88d37550c6d3a8c81b2b9782f42cb9c2e07dae42b4e9aebbd
cri-o-1.21.3-8.rhaos4.8.git7415a53.el8.s390x.rpm SHA-256: 3559bcba3b2b31b239cc1254a12f7658795b167eaaa56bbd3f830b1536ffa420
cri-o-debuginfo-1.21.3-8.rhaos4.8.git7415a53.el8.s390x.rpm SHA-256: 7922362d5498c178a90a68de81512591e9ccda1661269191ca45dba0bf0a7064
cri-o-debugsource-1.21.3-8.rhaos4.8.git7415a53.el8.s390x.rpm SHA-256: c88303f28989432f611aa8a249ebb3b2b280c09a601f7c52f532df201bc8b9aa
openshift-hyperkube-4.8.0-202110152028.p0.git.6438632.assembly.stream.el8.s390x.rpm SHA-256: cab3fb23db5fde370215b1bba9ec676fd7d91f10d4f82afc7223cc19ff219ae8
openshift-kuryr-cni-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.noarch.rpm SHA-256: df01405652ee7f474240c3b9606d8886c1807b1bc5197e09a93fef77c86a6712
openshift-kuryr-common-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.noarch.rpm SHA-256: 64efa502bcdef8b58c9e31367e796c8765d54a33f9201d9d592150205a479753
openshift-kuryr-controller-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.noarch.rpm SHA-256: de8f4631c4c589bf4389f503fba258dbe6d1e13582c41f9994343aaef4fda35d
ovn2.13-20.12.0-183.el8fdp.s390x.rpm SHA-256: 5fc290ddfb8b0357d3becec4b0b023c7ae372c734767d9129c0b7175b259227a
ovn2.13-central-20.12.0-183.el8fdp.s390x.rpm SHA-256: baede2db4232d7b85edc1a42e1d8620510f1b86d3daffcad91886bf3c970b8a9
ovn2.13-central-debuginfo-20.12.0-183.el8fdp.s390x.rpm SHA-256: a8feb2db6500ff2ea5a41fa47764b3e2beb0df98563afd08366d0ca5b1eed147
ovn2.13-debuginfo-20.12.0-183.el8fdp.s390x.rpm SHA-256: 80977597856551f9029b154e5f1a97103963c41acb7ebe969f401766bcd4b839
ovn2.13-debugsource-20.12.0-183.el8fdp.s390x.rpm SHA-256: 13bb737c928df81699fc4352646d4bdb2087fc3fc09b0880555c53d3c11ce7a4
ovn2.13-host-20.12.0-183.el8fdp.s390x.rpm SHA-256: c65bd77c7fe0e8e3d119c410d17c1993e578aa1d6e8e04e162a92ebd98336425
ovn2.13-host-debuginfo-20.12.0-183.el8fdp.s390x.rpm SHA-256: e09d0b176c8b4269f94019ac9c5e6aac4df068fbc3d962904647cfb9c638503a
ovn2.13-vtep-20.12.0-183.el8fdp.s390x.rpm SHA-256: 57550e1f72a20c9fd47eb1b920a024957d760bb95e344faa6c92b1ae82f06557
ovn2.13-vtep-debuginfo-20.12.0-183.el8fdp.s390x.rpm SHA-256: 61083b10faff9d3f2e98fc8e4739be006ff45f6b96b9eec2cc0f89e4ad406f75
python3-kuryr-kubernetes-4.8.0-202110140215.p0.git.15fa4c4.assembly.stream.el8.noarch.rpm SHA-256: a77f9b75de6c8fc7875e1eeb92042288015dbbf891fcdf3ab18a24c736c9e399

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.