(RHSA-2022:1476) Moderate: Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.4.3 images

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide some security fixes and bug fixes. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/

Security updates:

• golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565)

• nats-server: misusing the “dynamically provisioned sandbox accounts” feature authenticated user can obtain the privileges of the System account (CVE-2022-24450)

• nanoid: Information disclosure via valueOf() function (CVE-2021-23566)

• nodejs-shelljs: improper privilege management (CVE-2022-0144)

• search-ui-container: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor (CVE-2022-0155)

• node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)

• follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536)

• openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)

• imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path (CVE-2022-24778)

• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

• opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

Related bugs:

• RHACM 2.4.3 image files (BZ #2057249)

• Observability - dashboard name contains / would cause error when generating dashboard cm (BZ #2032128)

• ACM application placement fails after renaming the application name (BZ #2033051)

• Disable the obs metric collect should not impact the managed cluster upgrade (BZ #2039197)

• Observability - cluster list should only contain OCP311 cluster on OCP311 dashboard (BZ #2039820)

• The value of name label changed from clusterclaim name to cluster name (BZ #2042223)

• VMWare Cluster creation does not accept ecdsa-sha2-nistp521 ssh keys (BZ #2048500)

• clusterSelector matchLabels spec are cleared when changing app name/namespace during creating an app in UI (BZ #2053211)

• Application cluster status is not updated in UI after restoring (BZ #2053279)

• OpenStack cluster creation is using deprecated floating IP config for 4.7+ (BZ #2056610)

• The value of Vendor reported by cluster metrics was Other even if the vendor label in managedcluster was Openshift (BZ #2059039)

• Subscriptions stop reconciling after channel secrets are recreated (BZ #2059954)

• Placementrule is not reconciling on a new fresh environment (BZ #2074156)

• The cluster claimed from clusterpool cannot auto imported (BZ #2074543)