RHSA-2023:7200 - Security Advisory

Topic

Red Hat build of MicroShift release 4.15.0 is now available with updates to packages and images that fix several bugs.

This release includes a security update for Red Hat build of MicroShift 4.15.0.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge device deployments and is built from the edge capabilities of Red Hat OpenShift. MicroShift is an application that is deployed on top of Red Hat Enterprise Linux devices at
the edge, providing an efficient way to operate single-node clusters in these low-resource environments.

This advisory contains the RPM packages for Red Hat build of MicroShift 4.15.0. Read the following advisory for the container images for this
release:

https://access.redhat.com/errata/RHSA-2023:7198

Security Fix(es):

• golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)
• golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)
• golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For Red Hat build of MicroShift 4.15, read the following documentation for important instructions on how to install the latest RPMs and fully apply this asynchronous errata update:

https://access.redhat.com/documentation/en-us/red_hat_build_of_microshift/4.15/html/release_notes/index

Affected Products

• Red Hat OpenShift Container Platform 4.15 for RHEL 9 x86_64
• Red Hat OpenShift Container Platform for ARM 64 4.15 for RHEL 9 aarch64

Fixes

• BZ - 2243296 - CVE-2023-39325 golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
• BZ - 2253193 - CVE-2023-45287 golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.
• BZ - 2253330 - CVE-2023-39326 golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests
• OCPBUGS-18548 - MicroShift's KAS and KCM are not shutting down
• OCPBUGS-19288 - Update 4.15 ovn-kubernetes-microshift image to be consistent with ART
• OCPBUGS-19363 - systemd-resolved breaks microshift DNS pod
• OCPBUGS-19384 - Test harness: migrate from envsubst to gomplate
• OCPBUGS-19422 - no builtin components should report permission issues
• OCPBUGS-19433 - Ingress rules not checked in tests
• OCPBUGS-19457 - Missing upgrade test from "released RPMs" (ECs, RCs, Z-streams)
• OCPBUGS-19488 - cannot upgrade microshift 4.14 ec4 to rc1
• OCPBUGS-19540 - MicroShift doesn't print its version at the start
• OCPBUGS-19567 - Sos report helper to include full system journal
• OCPBUGS-19632 - Upgrade over unhealthy system leads to data loss
• OCPBUGS-19719 - mDNS resolution not working when retrieving logs
• OCPBUGS-20037 - Greenboot health check logs do not belong to the unit
• OCPBUGS-22685 - Update library-go in MicroShift 4.14
• OCPBUGS-22809 - microshift-selinux rpm post scriptlet fails
• OCPBUGS-22936 - microshift-data-cleanup fails if crio is not running
• OCPBUGS-22322 - Restart of MicroShift causes premature backup which will prevent creation of right backup
• OCPBUGS-22338 - No immediately obvious way to get the etcd version
• OCPBUGS-22858 - error printed greenboot-healthcheck output if system is non ostree-based
• OCPBUGS-22854 - microshift-release-info as a dependency on microshift
• OCPBUGS-25689 - MicroShift greenboot reports RED when no volume groups exist
• OCPBUGS-25851 - MicroShift OLM RPM is missing its release info file
• OCPBUGS-25904 - [release-4.15] MicroShift's cleanup script should stop and delete all (including user's) Pods
• OCPBUGS-27398 - Setting the advertiseAddress in the microshift config.yaml file leads to CrashLoopBackOff for the ovnkube-master pod
• OCPBUGS-27855 - [MicroShift] SERVFAIL due to "[ERROR] plugin/errors: dns: overflowing header size"

CVEs

• CVE-2023-39325
• CVE-2023-39326
• CVE-2023-45287

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/security/vulnerabilities/RHSB-2023-003