Lucene search

K
redhatRedHatRHSA-2022:4956
HistoryJun 08, 2022 - 12:06 p.m.

(RHSA-2022:4956) Important: Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes

2022-06-0812:06:26
access.redhat.com
40

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.016 Low

EPSS

Percentile

86.9%

Red Hat Advanced Cluster Management for Kubernetes 2.5.0 images

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs and security issues. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.5/html/release_notes/

Security fixes:

  • nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

  • containerd: Unprivileged pod may bind mount any privileged regular file on disk (CVE-2021-43816)

  • minio: user privilege escalation in AddUser() admin API (CVE-2021-43858)

  • openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)

  • imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path (CVE-2022-24778)

  • golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565)

  • node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)

  • nconf: Prototype pollution in memory store (CVE-2022-21803)

  • golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

  • nats-server: misusing the “dynamically provisioned sandbox accounts” feature authenticated user can obtain the privileges of the System account (CVE-2022-24450)

  • Moment.js: Path traversal in moment.locale (CVE-2022-24785)

  • golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

  • go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses (CVE-2022-29810)

  • opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

Bug fixes:

  • RFE Copy secret with specific secret namespace, name for source and name, namespace and cluster label for target (BZ# 2014557)

  • RHACM 2.5.0 images (BZ# 2024938)

  • [UI] When you delete host agent from infraenv no confirmation message appear (Are you sure you want to delete x?) (BZ#2028348)

  • Clusters are in ‘Degraded’ status with upgrade env due to obs-controller not working properly (BZ# 2028647)

  • create cluster pool -> choose infra type, As a result infra providers disappear from UI. (BZ# 2033339)

  • Restore/backup shows up as Validation failed but the restore backup status in ACM shows success (BZ# 2034279)

  • Observability - OCP 311 node role are not displayed completely (BZ# 2038650)

  • Documented uninstall procedure leaves many leftovers (BZ# 2041921)

  • infrastructure-operator pod crashes due to insufficient privileges in ACM 2.5 (BZ# 2046554)

  • Acm failed to install due to some missing CRDs in operator (BZ# 2047463)

  • Navigation icons no longer showing in ACM 2.5 (BZ# 2051298)

  • ACM home page now includes /home/ in url (BZ# 2051299)

  • proxy heading in Add Credential should be capitalized (BZ# 2051349)

  • ACM 2.5 tries to create new MCE instance when install on top of existing MCE 2.0 (BZ# 2051983)

  • Create Policy button does not work and user cannot use console to create policy (BZ# 2053264)

  • No cluster information was displayed after a policyset was created (BZ# 2053366)

  • Dynamic plugin update does not take effect in Firefox (BZ# 2053516)

  • Replicated policy should not be available when creating a Policy Set (BZ# 2054431)

  • Placement section in Policy Set wizard does not reset when users click “Back” to re-configured placement (BZ# 2054433)

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.016 Low

EPSS

Percentile

86.9%