RHSA-2023:5174 - Security Advisory

トピック

Red Hat OpenShift Service Mesh Containers for 2.4.3

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

説明

Red Hat OpenShift Service Mesh is the Red Hat distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.

This advisory covers container images for the release.

Security Fix(es):

• envoy: gRPC access log crash caused by the listener draining (CVE-2023-35942)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

解決策

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

影響を受ける製品

• Red Hat OpenShift Service Mesh 2 for RHEL 8 x86_64
• Red Hat OpenShift Service Mesh for Power 2 for RHEL 8 ppc64le
• Red Hat OpenShift Service Mesh for IBM Z 2 for RHEL 8 s390x
• Red Hat OpenShift Service Mesh for ARM 64 2 aarch64

修正

• BZ - 2217978 - CVE-2023-35942 envoy: gRPC access log crash caused by the listener draining
• OSSM-1182 - Deliver ARM images for OSSM Operator for Developer Preview
• OSSM-3508 - Ensure Cluster Ingress Operator can create cluster-wide SMCP
• OSSM-3979 - Implement envoyExtAuthzGrpc extension provider
• OSSM-4247 - Service details of ServiceEntry fails
• OSSM-4461 - Add FIPS annotation setting to kiali operator metadata
• OSSM-4559 - Panic in conversion of extensionProviders.envoyExtAuthzHttp
• OSSM-4627 - Add option to disable the GatewayClass controller
• OSSM-4705 - Removing subset in config - Fails to save
• OSSM-4491 - Add missing configuration options to meshConfig.extensionProviders.envoyExtAuthzHttp

CVE

• CVE-2023-2602
• CVE-2023-2603
• CVE-2023-3899
• CVE-2023-27536
• CVE-2023-28321
• CVE-2023-28484
• CVE-2023-29469
• CVE-2023-32681
• CVE-2023-34969
• CVE-2023-35942

参考資料

• https://access.redhat.com/security/updates/classification/#moderate