RHSA-2022:2183 - Security Advisory

Topic

Red Hat OpenStack Platform 16.2 (Train) director Operator containers are
available for technology preview.

Description

Release osp-director-operator images

Security Fix(es):

• golang: kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote (CVE-2019-11253)
• golang: golang-github-miekg-dns: predictable TXID can lead to response forgeries (CVE-2019-19794)
• golang: containerd: unrestricted access to abstract Unix domain socket can lead to privileges (CVE-2020-15257)
• golang: ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)
• golang: containerd: pulling and extracting crafted container image may result in Unix file permission changes (CVE-2021-32760)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

Solution

OSP 16.2 Release - OSP Director Operator Containers tech preview

Affected Products

• Red Hat OpenStack 16.2 x86_64

Fixes

• BZ - 1757701 - CVE-2019-11253 kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service
• BZ - 1786761 - CVE-2019-19794 golang-github-miekg-dns: predictable TXID can lead to response forgeries
• BZ - 1899487 - CVE-2020-15257 containerd: unrestricted access to abstract Unix domain socket can lead to privileges escalation
• BZ - 1954368 - CVE-2021-29482 ulikunitz/xz: Infinite loop in readUvarint allows for denial of service
• BZ - 1982681 - CVE-2021-32760 containerd: pulling and extracting crafted container image may result in Unix file permission changes
• BZ - 2079447 - Rebase tech preview on latest upstream v1.2.x branch

CVEs

• CVE-2018-25032
• CVE-2019-11253
• CVE-2019-19794
• CVE-2020-15257
• CVE-2021-29482
• CVE-2021-32760
• CVE-2022-1154
• CVE-2022-1271

References

• https://access.redhat.com/security/updates/classification/#moderate