RHSA-2023:4694 - Security Advisory

Topic

Red Hat OpenStack Platform (RHOSP) 16.2.z (Train) director Operator containers are now available.

Description

Release of Red Hat OpenStack Platform (RHOSP) 16.2.z (Train) provides these changes:

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack 16.2 x86_64

Fixes

• BZ - 2215317 - CVE-2022-21235 github.com/Masterminds/vcs: Command Injection via argument injection
• BZ - 2218300 - git url logic does not handle non-default ports and users
• BZ - 2228513 - [16.2] Ephemeral heat communication is not using svc fqdn and hitting proxy
• BZ - 2229173 - [16.2] OpenStackConfigGenerator fails to clone from Azure DevOps with empty git-upload-pack given
• OSPK8-735 - Improve logging for BMH selection in BaremetalSet controller

CVEs

• CVE-2020-24736
• CVE-2022-21235
• CVE-2022-36227
• CVE-2023-0361
• CVE-2023-1667
• CVE-2023-2283
• CVE-2023-2602
• CVE-2023-2603
• CVE-2023-27536
• CVE-2023-28321
• CVE-2023-28484
• CVE-2023-29469

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/16.2/html/release_notes