RHSA-2023:4582 - Security Advisory

标题

Red Hat OpenStack Platform 17.1 (Wallaby) director Operator containers are now available.

描述

Release of Red Hat OpenStack Platform 17.1 (Wallaby) director Operator containers provides these changes:

Security Fix(es):

• github.com/Masterminds/vcs: Command Injection via argument injection (CVE-2022-21235)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

解决方案

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

受影响的产品

• Red Hat OpenStack 17.1 for RHEL 9 x86_64

修复

• BZ - 2215019 - Update osp-director-operator references to GA locations
• BZ - 2215317 - CVE-2022-21235 github.com/Masterminds/vcs: Command Injection via argument injection
• BZ - 2218299 - git url logic does not handle non-default ports and users
• BZ - 2221326 - Playbooks list is ignored for FFU and minor update
• OSPK8-701 - nil ptr can hide actual error

CVE

• CVE-2022-21235

参考

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/17.1/html/release_notes