RHSA-2022:6283 - Security Advisory

Topic

Red Hat OpenShift Service Mesh 2.2.2 Containers

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.

This advisory covers the RPM packages for the release.

Security Fix(es):

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

The OpenShift Service Mesh Release Notes provide information on the features and known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html

Affected Products

• Red Hat OpenShift Service Mesh 2 for RHEL 8 x86_64
• Red Hat OpenShift Service Mesh for Power 2 for RHEL 8 ppc64le
• Red Hat OpenShift Service Mesh for IBM Z 2 for RHEL 8 s390x

Fixes

• BZ - 2107371 - CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
• BZ - 2107376 - CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
• BZ - 2107386 - CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
• BZ - 2107388 - CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode
• BZ - 2107390 - CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
• BZ - 2107392 - CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal
• OSSM-1868 - Container release for Maistra 2.2.2
• OSSM-1105 - IOR doesn't support a host with namespace/ prefix
• OSSM-1205 - Specifying logging parameter will make istio-ingressgateway and istio-egressgateway failed to start
• OSSM-1668 - [Regression] jwksResolverCA field in SMCP is missing
• OSSM-1718 - Istio Operator pauses reconciliation when gateway deployed to non-control plane namespace
• OSSM-1775 - [Regression] Incorrect 3scale image specified for 2.0 control planes
• OSSM-1800 - IOR should copy labels from Gateway to Route
• OSSM-1805 - Reconcile SMCP when Kiali is not available
• OSSM-1846 - SMCP fails to reconcile when enabling PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER

CVEs

• CVE-2022-1292
• CVE-2022-1586
• CVE-2022-1705
• CVE-2022-1785
• CVE-2022-1897
• CVE-2022-1927
• CVE-2022-1962
• CVE-2022-2068
• CVE-2022-2097
• CVE-2022-28131
• CVE-2022-30630
• CVE-2022-30632
• CVE-2022-30633
• CVE-2022-30635
• CVE-2022-31107
• CVE-2022-32148

References

• https://access.redhat.com/security/updates/classification/#moderate