- Issued:
- 2023-08-16
- Updated:
- 2023-08-16
RHSA-2023:4582 - Security Advisory
Synopsis
Moderate: Release of containers for Red Hat OpenStack Platform 17.1 director Operator
Type/Severity
Security Advisory: Moderate
Topic
Red Hat OpenStack Platform 17.1 (Wallaby) director Operator containers are now available.
Description
Release of Red Hat OpenStack Platform 17.1 (Wallaby) director Operator containers provides these changes:
Security Fix(es):
- github.com/Masterminds/vcs: Command Injection via argument injection (CVE-2022-21235)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
Affected Products
- Red Hat OpenStack 17.1 for RHEL 9 x86_64
Fixes
- BZ - 2215019 - Update osp-director-operator references to GA locations
- BZ - 2215317 - CVE-2022-21235 github.com/Masterminds/vcs: Command Injection via argument injection
- BZ - 2218299 - git url logic does not handle non-default ports and users
- BZ - 2221326 - Playbooks list is ignored for FFU and minor update
- OSPK8-701 - nil ptr can hide actual error
CVEs
x86_64
rhosp-rhel9/osp-director-agent@sha256:197160a2e744eb53a6e152407c825cc3e2a88830a4feba01aabbd11d9b16e404 |
rhosp-rhel9/osp-director-downloader@sha256:61159eadd71ed20f274f22007347860a5569db386e8c70da6cb4cbcaf3a4bc59 |
rhosp-rhel9/osp-director-operator@sha256:af6ac5429c7243d9faf4e13b6c337b2e8beb17adc7c44beaac74787c3b71ebf2 |
rhosp-rhel9/osp-director-operator-bundle@sha256:c41549c229cb7af7034a0711f715be1b75695830cdcf7c524230508a5f938717 |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.