Red Hat Product Errata RHSA-2022:1476 - Security Advisory
Issued:
2022-04-20
Updated:
2022-04-20

RHSA-2022:1476 - Security Advisory

Synopsis

Moderate: Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes

Type/Severity

Security Advisory: Moderate

Topic

Red Hat Advanced Cluster Management for Kubernetes 2.4.3 General Availability release images. This update provides security fixes, bug fixes, and updates the container images.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.

Description

Red Hat Advanced Cluster Management for Kubernetes 2.4.3 images

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide some security fixes and bug fixes. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/

Security updates:

  • golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565)
  • nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account (CVE-2022-24450)
  • nanoid: Information disclosure via valueOf() function (CVE-2021-23566)
  • nodejs-shelljs: improper privilege management (CVE-2022-0144)
  • search-ui-container: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor (CVE-2022-0155)
  • node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
  • follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536)
  • openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)
  • imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path (CVE-2022-24778)
  • golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
  • opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

Related bugs:

  • RHACM 2.4.3 image files (BZ #2057249)
  • Observability - dashboard name contains `/` would cause error when generating dashboard cm (BZ #2032128)
  • ACM application placement fails after renaming the application name (BZ #2033051)
  • Disable the obs metric collect should not impact the managed cluster upgrade (BZ #2039197)
  • Observability - cluster list should only contain OCP311 cluster on OCP311 dashboard (BZ #2039820)
  • The value of name label changed from clusterclaim name to cluster name (BZ #2042223)
  • VMWare Cluster creation does not accept ecdsa-sha2-nistp521 ssh keys (BZ #2048500)
  • clusterSelector matchLabels spec are cleared when changing app name/namespace during creating an app in UI (BZ #2053211)
  • Application cluster status is not updated in UI after restoring (BZ #2053279)
  • OpenStack cluster creation is using deprecated floating IP config for 4.7+ (BZ #2056610)
  • The value of Vendor reported by cluster metrics was Other even if the vendor label in managedcluster was Openshift (BZ #2059039)
  • Subscriptions stop reconciling after channel secrets are recreated (BZ #2059954)
  • Placementrule is not reconciling on a new fresh environment (BZ #2074156)
  • The cluster claimed from clusterpool cannot auto imported (BZ #2074543)

Solution

For Red Hat Advanced Cluster Management for Kubernetes, see the following
documentation, which will be updated shortly for this release, for important
instructions on how to upgrade your cluster and fully apply this asynchronous
errata update:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/index

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html-single/install/index#installing

Affected Products

  • Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 8 x86_64
  • Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 7 x86_64

Fixes

  • BZ - 2024938 - CVE-2021-41190 opencontainers: OCI manifest and index parsing confusion
  • BZ - 2030787 - CVE-2021-43565 golang.org/x/crypto: empty plaintext packet causes panic
  • BZ - 2032128 - Observability - dashboard name contains `/` would cause error when generating dashboard cm
  • BZ - 2033051 - ACM application placement fails after renaming the application name
  • BZ - 2039197 - disable the obs metric collect should not impact the managed cluster upgrade
  • BZ - 2039820 - Observability - cluster list should only contain OCP311 cluster on OCP311 dashboard
  • BZ - 2042223 - the value of name label changed from clusterclaim name to cluster name
  • BZ - 2043535 - CVE-2022-0144 nodejs-shelljs: improper privilege management
  • BZ - 2044556 - CVE-2022-0155 follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
  • BZ - 2044591 - CVE-2022-0235 node-fetch: exposure of sensitive information to an unauthorized actor
  • BZ - 2048500 - VMWare Cluster creation does not accept ecdsa-sha2-nistp521 ssh keys
  • BZ - 2050853 - CVE-2021-23566 nanoid: Information disclosure via valueOf() function
  • BZ - 2052573 - CVE-2022-24450 nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account
  • BZ - 2053211 - clusterSelector matchLabels spec are cleared when changing app name/namespace during creating an app in UI
  • BZ - 2053259 - CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak
  • BZ - 2053279 - Application cluster status is not updated in UI after restoring
  • BZ - 2056610 - OpenStack cluster creation is using deprecated floating IP config for 4.7+
  • BZ - 2057249 - RHACM 2.4.3 images
  • BZ - 2059039 - The value of Vendor reported by cluster metrics was Other even if the vendor label in managedcluster was Openshift
  • BZ - 2059954 - Subscriptions stop reconciling after channel secrets are recreated
  • BZ - 2062202 - CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  • BZ - 2064702 - CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server
  • BZ - 2069368 - CVE-2022-24778 imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path
  • BZ - 2074156 - Placementrule is not reconciling on a new fresh environment
  • BZ - 2074543 - The cluster claimed from clusterpool can not auto imported

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.