RHSA-2024:4455 - Security Advisory

Topic

Red Hat OpenShift Virtualization release 4.16.0 is now available with updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.

This advisory contains OpenShift Virtualization 4.16.0 images.

Security Fix(es):

• axios: exposure of confidential data stored in cookies (CVE-2023-45857)
• golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)
• jose-go: improper handling of highly compressed data (CVE-2024-28180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Container Native Virtualization 4.16 for RHEL 9 x86_64
• Red Hat Container Native Virtualization for ARM 64 4.16 for RHEL 9 aarch64

Fixes

• BZ - 2248979 - CVE-2023-45857 axios: exposure of confidential data stored in cookies
• BZ - 2268046 - CVE-2024-24786 golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
• BZ - 2268854 - CVE-2024-28180 jose-go: improper handling of highly compressed data
• CNV-34884 - Missing qemu log error at at virt-handler/launcher or virtualmachinemigration status
• CNV-31319 - [2225227] Tekton: Consistent behavior in bios & efi pipelines for dv creation
• CNV-29431 - [2212590] 1 vcpu realtime VM hangs with CNV
• CNV-29298 - [2211266] Since LUN type is greyed out from UI in OCP version 4.10 and 4.12, we are not able to select LUN type with SCSI interface when adding hotplug
• CNV-33836 - Duplicated lines existed in virt-controller deployment command part after adding annotation to HyperConverged CR
• CNV-37629 - Configure public SSH key from existing key not work
• CNV-35213 - [tier1-kubevirt-compute] CPU hotplug with dedicated CPU placement tests are very flaky in upstream
• CNV-33529 - [2240971] After upgrade?4.13.4 -> 4.14.0?cdi-insecure-registries?configmap version not updated
• CNV-35859 - [2252097] [DPDK checkup] tuned-adm parameters only updated after VM reboot
• CNV-35763 - Search box disappears if no VM matches filter
• CNV-32997 - [2239038] validating webhook required for virtualMachineMigrationResourceQuota
• CNV-37788 - The link of InstanceType in VM overview tab is not working
• CNV-37412 - Make "Instancetypes" and "Preferences" list page available for regular user
• CNV-37667 - Remove info notification "All settings are effective across the entire cluster" from the Settings pages
• CNV-37501 - [RFE] Improve the example of SSH using virtctl
• CNV-36271 - VMExport download: should reject the command when --output is not specified
• CNV-37376 - Align ssp monitoring metrics and tools with the other kubevirt operators
• CNV-37377 - Handle records without ebs_account label
• CNV-35729 - Improve modal save while there are changes occurred in the back-end
• CNV-29476 - [2212911] SSP alerts dont have Prometheus unit tests
• CNV-37378 - virt-controller panic: "invalid memory address or nil pointer dereference"
• CNV-32812 - [2237949] Global permission [*] is seen in openshift-virtualization csv file for hostpath-provisioner-operator
• CNV-30877 - [2222122] VirtualMachineClone object should be removed when associated VM deleted
• CNV-23927 - [2158322] [console] When deleting VM, 'Delete disks' checkbox includes PVC of cd-rom with ISO in the count
• CNV-38568 - ksm-enabled node label is true only when there is a node pressure ongoing
• CNV-35452 - When VM snapshot fails becuse the VolumeSnapshot fails, the UI is not exposing the reason
• CNV-18671 - [2089722] Expose disk serial number via virtctl
• CNV-38655 - Update actions text in snapshots tab
• CNV-38883 - Link from RHEL Activation key card to docs is 404
• CNV-37857 - In the create VM from template flow, add an indication that a public ssh key isn't configured before creating a VM
• CNV-33184 - [2239895] Virt launcher takes approx 4-5 mins to start back when a node is down
• CNV-35728 - Failed VMIM does not explain the failure reason
• CNV-33701 - When using Memory Hotplug you cannot define memory limits
• CNV-38724 - Fix `EmulatedMachines` KV CR setting
• CNV-38707 - VMExport: when using '?output -' - we save all stdout to the disk.img, results in broken disk.img
• CNV-33527 - [2240963] VM shows DataVolumeError during DV provisioning
• CNV-32664 - [2237678] VM snapshot is failing during fsfreeze with permission denied error
• CNV-39753 - NNS UI - Filtering by IPv4 and IPv6 does not work
• CNV-39618 - Smoke tests blocker: Clone of DV to VM with DataVolumeTemplate - reports DV Succeeded instantly, but PVC is Pending
• CNV-39418 - MigrationPolicy matches on VMI labels, not VM labels
• CNV-39028 - UI generated VirtualMachine provides an instance type kind when one isn't required
• CNV-36211 - [CWE-79] release-v1.56 - containerized-data-importer - ?pkg/uploadproxy/uploadproxy.go - Cross-site Scripting (XSS)
• CNV-36210 - [CWE-79] release-v1.57 - containerized-data-importer - ?pkg/uploadproxy/uploadproxy.go - Cross-site Scripting (XSS)
• CNV-36209 - [CWE-79] release-v1.55 - containerized-data-importer - ?pkg/uploadproxy/uploadproxy.go - Cross-site Scripting (XSS)
• CNV-36208 - [CWE-79] main - containerized-data-importer - ?pkg/uploadproxy/uploadproxy.go - Cross-site Scripting (XSS)
• CNV-35782 - VM nic is still showing in the network list after deleting it
• CNV-31828 - Improve virt-controller TSC related logs
• CNV-28040 - [2186372] Packet drops during the initial phase of VM live migration
• CNV-39893 - AAQ: PODs remain in gated state after removing label from the namespace
• CNV-38700 - creating multiple AAQ objects may lead to aaq-operator in CrashLoopBackOff state
• CNV-39880 - `oc debug` command does not work when AAQ enabled
• CNV-39878 - After enabling AAQ there is an error 'x509: certificate signed by unknown authority' occurs when executing 'oc logs' or 'oc exec' commands
• CNV-39421 - [memory hotplug] failed to update guest memory after migration
• CNV-37462 - Search in "Guest system access log" page crashes the page
• CNV-29869 - hotplug volume fails during csi test when volume is attached/detached too quickly
• CNV-37859 - must-gather: Multiple empty files under vms/<vm-name> if the VM was live migrated
• CNV-40334 - VM tabs become blank by clicking the link of "Make persistent disk"
• CNV-40136 - [UI] virt-launcher pod intermittently 404 when navigating from VM page
• CNV-39978 - ARQ should show guest virtual resources usage when memory overcommitment utilized
• CNV-39752 - NNS UI - Allow expanding of all entries
• CNV-39101 - Repeating log message in aaq-controller pod after removing the Namespace
• CNV-38404 - ListPageFilter search with / do not work
• CNV-38375 - ListPageFilter support hideLabelfilter and hideNameLabelFilters
• CNV-37383 - Missing explanation about how to fix a missing authorized SSH key
• CNV-36299 - Node list is not sorted on NodeNetworkState page
• CNV-34072 - [RFE] Improve IP address information list
• CNV-40457 - Instancetype list is empty on catalog -> instanceTypes page
• CNV-40200 - "Create" should be "Clone" while clone a VM
• CNV-40196 - PVC is not found in "Bootable volumes" -> Add volume modal
• CNV-40120 - VolumeSnapshots is not available in Catalog -> Add volume modal
• CNV-36837 - RHEL templates cannot be used to create VMs
• CNV-40006 - MAC spoof checkbox is not affecting the NAD config
• CNV-39722 - VM tabs cannot be loaded if the VM name includes the tab name
• CNV-39659 - Change "CPU limit" to "CPU limits"
• CNV-39469 - The placeholder text "--- Select secret ---" should be "Select secret"
• CNV-39425 - Not able to select use prefereces in add volume modal
• CNV-37111 - Bootable volume list page fix table
• CNV-36130 - e2e tests using deprecated kubevirt.io/v1alpha3 API
• CNV-40846 - Reorganize utils folder Networking-console-plugin
• CNV-40886 - A small box show up while typing in checkup's form
• CNV-40598 - Storage check default timeout should allowed in UI
• CNV-40161 - The default tab is "Storage" when visiting Checkups page
• CNV-40341 - Improve "Create VirtualMachine from snapshot" modal
• CNV-39995 - VM ssh tab is crashed when metalLB operator is installed
• CNV-38270 - UI not exposing vmsnapshot ready and status `Error`
• CNV-37382 - Inconsistency between the cluster settings and VM settings for SSH over LoadBalancer
• CNV-37373 - VM IP address disappears from UI when migrating VM
• CNV-39030 - VirtualMachine details page links to the original instance type and preference resources instead of the snapshots captured by ControllerRevisoins
• CNV-38450 - VM without ssh crashes console
• CNV-38887 - Tier1 kubevirt storage: cleanup leftovers storageclasses
• CNV-38129 - kubemacpool-cert-manager: Average memory usage Increase with no additional CNV load
• CNV-37685 - node-labeller does not add Skylake, Cascadelake and Icelake labels if node is missing mpx.
• CNV-40164 - Disable caching of the json files
• CNV-41386 - "Boot disk size" is empty while creating VM from instanceType
• CNV-39941 - No GUI indication when the LoadBalancer service is not bound yet.
• CNV-41495 - UI does not allow changing a disk bus type after the volume creation
• CNV-41139 - UI's "Learn more" points at upstream user-guide
• CNV-41084 - Click VM conditions leads to blank page
• CNV-41507 - [4.16] CDIStorageProfilesIncomplete caused Openshift Virtualization operator status go degraded
• CNV-41494 - Create from Volume flow falsely sets disk bus to virtio
• CNV-41402 - Cannot add environment disk to VM when the VM is created from instanceType
• CNV-41199 - Remove link from instanceType in modal "Create VirtualMachine from snapshot"
• CNV-41579 - The toggle button of "Enable memory density" is not clickable
• CNV-39685 - Cannot change Boot mode from "BIOS" to "UEFI (Secure)"
• CNV-41206 - Dynamic SSH key injection checked if it should be not enabled
• CNV-39727 - Selecting a boot volume in the table always takes you to the table first page
• CNV-41550 - Crash on catalog when quickstart do not exist
• CNV-41210 - UI shows `virtctl ssh` example twice
• CNV-41640 - Miss space in the hint about "Interested in using a Windows Bootable Volume"
• CNV-41632 - Cannot type MigrationPolicy name and description
• CNV-41385 - Disable "Auto-compute CPU limits" does not remove autoCPULimitNamespaceLabelSelector from HCO
• CNV-41195 - AAQ Gate Controller: Endless reconciliation loop on terminating namespace
• CNV-40258 - Imported Windows VMs Incorrectly Set to Use SSH Instead of WinRM
• CNV-39034 - [arm64] CNV Templates on arm64 shows machine-type pc-q35-rhel9.2.0
• CNV-39056 - Incorrect display of used cpu in ARQ when set it through 'requests.cpu'
• CNV-41224 - Create new VirtualMachine list outdated PVCs as base image
• CNV-41209 - No interfaces is listed on VM overview
• CNV-40455 - NAD is always created to the default namespace
• CNV-40445 - UI: When trying to see why OpenshiftVirtualization Degraded - getting an empty page
• CNV-40419 - Button "Customize VirtualMachine" disabled due to processedtemplate permission
• CNV-40162 - The yaml editor of checkup's results is too small
• CNV-39558 - The text improvement - Set SSH over NodePort, we should provide the clear text to guide user to contact cluster admin to enable it in the cluster
• CNV-40335 - Click the labels of instanceType/preference does not open the search list correctly
• CNV-41604 - It shows "No boot source available" when installing from ISO
• CNV-41600 - The storage usage is wrong on utilization card under VM's overview
• CNV-41844 - Improve sysprep section while using existing sysprep
• CNV-41286 - "Create VirtualMachine" from snapshot is disabled for regular user
• CNV-42015 - SSH key is cleared when creating VM from template
• CNV-41959 - Console is crashed while creating VM from cloned template
• CNV-41203 - The download virtctl in overview should point to the main download section
• CNV-41772 - Forklift populator missing from CDI
• CNV-41355 - InstanceTypes are incompatible with hot plug, but hotplug will be enabled by default
• CNV-40776 - Limited selection of CPU models in node labels
• CNV-40336 - Migration chart is empty
• CNV-41474 - [4.16] Clone takes more space in 4.14 - on hostpath-csi-pvc-block storage
• CNV-40682 - [4.16] [Tracker] Migration is broken
• CNV-41503 - [OCP Virt] Empty advanced dashboards after enabling schedstats=enable on kernel hypervisor
• CNV-40344 - The expanded sections in Overview -> settings are not indented
• CNV-41200 - Popup text for dynamic SSH key injection is misleading
• CNV-41846 - Changes in configuration tab does not save to YAML tab
• CNV-40242 - UI goes blank when changing the storage class field when adding a disk
• CNV-42363 - Forklift: Rename API group
• CNV-41526 - Cannot enable ssh service while creating VM from instanceType due to the VM is not created yet
• CNV-41522 - Flow of customize IT
• CNV-42853 - Sorting Instance Boot Volume by name does not work
• CNV-42052 - Unable to create or interact with VirtualMachines using instance types with the VMLiveUpdateFeatures FG enabled
• CNV-42844 - VM with CPU requests/limits is simply rejected
• CNV-42786 - Windows VM with sysprep cannot be started due to configMap of sysprep not found
• CNV-43024 - CNV4.16: Failed to passthrough usb device to VM
• CNV-42087 - Improve sysprep section when the answer file is added
• CNV-41804 - VM Overview should show the name of the instancetype and preference
• CNV-41590 - sysprep volume missing on creation of a VM with Sysprep
• CNV-40903 - UI does not allow SSH key injection on RHEL 9
• CNV-43033 - starting VM with Hugepages configured is causing virt-controller pods to crash
• CNV-43069 - Creating a VMPool when vmRolloutStrategy set to LiveUpdate crashes virt-api
• CNV-43041 - VM with 4GB and 1GB of memory fail to launch
• CNV-43039 - VM with GPU and vGPU passthrough fails to start with LibvirtError
• CNV-43027 - VM with Hugepages is failing to start
• CNV-43205 - Memory hotplug with hugepages does not complete
• CNV-43194 - VM with instance type does not start
• CNV-42622 - KubeVirtVMIExcessiveMigrations alert dosent have namespace
• CNV-42884 - Graceful deletion skipped for any delete call to the VM (not VMI) resource
• CNV-23541 - [2155768] Permissions to run tekton pipelines for non cluster roles or maybe with time bound tokens
• CNV-34180 - Regular user cannot add GPU devices to VM
• CNV-34488 - [2246374] VM latency checkup, log: ping parser: failed to parse 'time': time: invalid duration "ms"
• CNV-38596 - Guest system access log takes long time to load
• CNV-38608 - Virtualization Migrations page is not available for nonpriv user
• CNV-38609 - Nonpriv user can't create a VM from catalog
• CNV-38902 - Create MigrationPolicy button isn't always shown
• CNV-39371 - When using CPU Hotplug you cannot define cpu limits
• CNV-39682 - UI: Misbehavior when creating a VM in a project without RBAC permissions
• CNV-39940 - UI does not show installed version in cnv2 virtualization-overview/settings
• CNV-39946 - Regular user cannot create vm with their own volumes from UI

CVEs

• CVE-2021-35937
• CVE-2021-35938
• CVE-2021-35939
• CVE-2021-40153
• CVE-2021-41072
• CVE-2021-43618
• CVE-2021-46848
• CVE-2022-1271
• CVE-2022-1304
• CVE-2022-2509
• CVE-2022-3715
• CVE-2022-28805
• CVE-2022-34903
• CVE-2022-36227
• CVE-2022-36763
• CVE-2022-36764
• CVE-2022-47024
• CVE-2022-47629
• CVE-2022-48303
• CVE-2022-48468
• CVE-2022-48554
• CVE-2023-2602
• CVE-2023-2603
• CVE-2023-2975
• CVE-2023-3446
• CVE-2023-3817
• CVE-2023-4408
• CVE-2023-4641
• CVE-2023-5215
• CVE-2023-5363
• CVE-2023-5517
• CVE-2023-5678
• CVE-2023-5679
• CVE-2023-5871
• CVE-2023-6004
• CVE-2023-6129
• CVE-2023-6237
• CVE-2023-6516
• CVE-2023-6597
• CVE-2023-6918
• CVE-2023-7008
• CVE-2023-7104
• CVE-2023-22745
• CVE-2023-27043
• CVE-2023-28486
• CVE-2023-28487
• CVE-2023-29491
• CVE-2023-30630
• CVE-2023-32681
• CVE-2023-33460
• CVE-2023-34969
• CVE-2023-36054
• CVE-2023-39975
• CVE-2023-42465
• CVE-2023-45229
• CVE-2023-45231
• CVE-2023-45232
• CVE-2023-45233
• CVE-2023-45235
• CVE-2023-45857
• CVE-2023-47038
• CVE-2023-50387
• CVE-2023-50868
• CVE-2023-52425
• CVE-2024-0450
• CVE-2024-0727
• CVE-2024-1488
• CVE-2024-2961
• CVE-2024-3651
• CVE-2024-22365
• CVE-2024-24786
• CVE-2024-25062
• CVE-2024-28180
• CVE-2024-28182
• CVE-2024-28757
• CVE-2024-28834
• CVE-2024-28835
• CVE-2024-32002
• CVE-2024-32004
• CVE-2024-32020
• CVE-2024-32021
• CVE-2024-32465
• CVE-2024-32487
• CVE-2024-33599
• CVE-2024-33600
• CVE-2024-33601
• CVE-2024-33602

References

• https://access.redhat.com/security/updates/classification/#moderate