RHSA-2024:1946 - Security Advisory

Topic

Red Hat OpenShift Service Mesh Containers for 2.5.1

This update has a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.

Security Fixes:

• follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() (CVE-2023-26159)
• golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)
• jose-go: improper handling of highly compressed data (CVE-2024-28180)
• follow-redirects: Possible credential leak (CVE-2024-28849)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Service Mesh 2 for RHEL 8 x86_64
• Red Hat OpenShift Service Mesh for Power 2 for RHEL 8 ppc64le
• Red Hat OpenShift Service Mesh for IBM Z 2 for RHEL 8 s390x
• Red Hat OpenShift Service Mesh for ARM 64 2 aarch64

Fixes

• OSSM-5541 - istio-operator Pod keeps waiting for leader lease for over 30 minutes without timeout.
• OSSM-5902 - Istio config href is broken in OSSMC
• OSSM-5959 - TLS and Istio certifications information are not available in OSSMC
• OSSM-5960 - Notification messages are not shown in OSSMC
• OSSM-5961 - Warning in workload 'istio-ingressgateway' in non control-plane namespace
• OSSM-5997 - OSSMC breaks on Namespace mesh-external
• OSSM-6080 - Rebuild `ext-authz` P/Z images
• OSSM-6099 - Installing OSSMC plugin fails on IPv6 cluster
• OSSM-6148 - [OSSMC] Traffic graph context menu options do not redirect to the correct pages
• OSSM-6163 - OSSM 2.5.0 Fix Prometheus and Grafana dashboard errors
• OSSM-6177 - Istiod keeps crashing ending up in Crashloopbackoff after upgrade to v2.5.0
• OSSM-6261 - Nil pointer dereference in istiod's client.Shutdown()
• OSSM-6264 - content-type issue for OpenShift auth
• OSSM-6101 - Istiod-basic POD is crashing with an error "fatal error: concurrent map read and map write"
• OSSM-6289 - Enabling "validationMessages" in the SMCP causes istiod pod to log errors and never get into ready state

CVEs

• CVE-2021-43618
• CVE-2022-3821
• CVE-2022-4415
• CVE-2022-48624
• CVE-2023-4408
• CVE-2023-7104
• CVE-2023-26159
• CVE-2023-26604
• CVE-2023-28322
• CVE-2023-38546
• CVE-2023-46218
• CVE-2023-50387
• CVE-2023-50868
• CVE-2023-52425
• CVE-2024-0553
• CVE-2024-1394
• CVE-2024-1488
• CVE-2024-24786
• CVE-2024-28180
• CVE-2024-28834
• CVE-2024-28849

References

• https://access.redhat.com/security/updates/classification/#moderate