Red Hat Product Errata RHSA-2023:6219 - Security Advisory
Issued:
2023-10-31
Updated:
2023-10-31

RHSA-2023:6219 - Security Advisory

Synopsis

Important: Red Hat Service Interconnect security update

Type/Severity

Security Advisory: Important

Topic

An update is now available for Service Interconnect 1 for RHEL 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Security Fix(es):

  • skupper-operator: privelege escalation via config map (CVE-2023-5056)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Service Interconnect 1 for RHEL 9 x86_64

Fixes

  • BZ - 2239517 - CVE-2023-5056 skupper-operator: privelege escalation via config map
  • SKUPPER-1064 - Console branding is dark
  • SKUPPER-1118 - Skupper Service Controller references images without the fully qualified image name
  • SKUPPER-1250 - Unexposing services not working
  • SKUPPER-1251 - Exposed statefulset services dont get deleted after unexposing
  • SKUPPER-1252 - Proton Raw connections do not always complete close operations

x86_64

service-interconnect/skupper-config-sync-rhel9@sha256:f82d24d7ce24dde945578531cbfc91d0aaf59eed382eb9181b70dbcfcc8d00e3
service-interconnect/skupper-flow-collector-rhel9@sha256:b7ef43814976f60eb84d77b8a4eb71d2a2e18dbab6b547e6c4fd367f8d168e27
service-interconnect/skupper-operator-bundle@sha256:0dc569d8a1fd4571337d479246b1f460f25086bbb9ab4fac076580358305feb6
service-interconnect/skupper-router-rhel9@sha256:81c093e157e90505c35e8908df956d56ababd80b44ffa83de33b06254dd4a706
service-interconnect/skupper-service-controller-rhel9@sha256:9850f93b601479572bdcd4bedd9bf509ed6120b01f6683a5073bce44fb13f9c6
service-interconnect/skupper-site-controller-rhel9@sha256:8a00cb04024b496f1e4ace1ee58942387f49e3db77f47dbc2983d503dbf78282

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.