[RHSA-2022:0409-01] Important: Red Hat Single Sign-On 7.4.10 on OpenJDK for OpenShift image security update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat Single Sign-On 7.4.10 on OpenJDK for OpenShift image security update
Advisory ID:       RHSA-2022:0409-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:0409
Issue date:        2022-02-02
CVE Names:         CVE-2021-3859 CVE-2022-21248 CVE-2022-21277 
                   CVE-2022-21282 CVE-2022-21283 CVE-2022-21291 
                   CVE-2022-21293 CVE-2022-21294 CVE-2022-21296 
                   CVE-2022-21299 CVE-2022-21305 CVE-2022-21340 
                   CVE-2022-21341 CVE-2022-21360 CVE-2022-21365 
                   CVE-2022-21366 
=====================================================================

1. Summary:

A new image is available for Red Hat Single Sign-On 7.4.10 on OpenJDK,
running on OpenShift Container Platform 3.10 and 3.11, and 4.3.

2. Description:

Red Hat Single Sign-On is an integrated sign-on solution, available as a
Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat
Single Sign-On for OpenShift image provides an authentication server that
you can use to log in centrally, log out, and register. You can also manage
user accounts for web applications, mobile applications, and RESTful web
services.

This erratum releases a new image for Red Hat Single Sign-On 7.4.10 for
use within the OpenShift Container Platform 3.10, OpenShift Container
Platform
3.11, and within the OpenShift Container Platform 4.3 cloud computing
Platform-as-a-Service (PaaS) for
on-premise or private cloud deployments, aligning with the standalone
product release.

Security Fix(es):

* undertow: client side invocation timeout raised when calling over HTTP
and
HTTP2 (CVE-2021-3859)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the
References section.

3. Solution:

To update to the latest Red Hat Single Sign-On 7.4.10 for OpenShift
image, Follow these steps to pull in the content:

1. On your master hosts, ensure you are logged into the CLI as a
cluster administrator or user with project administrator access
to the global "openshift" project. For example:

$ oc login -u system:admin

2. Update the core set of Red Hat Single Sign-On resources for OpenShift
in the "openshift" project by running the following commands:

$ for resource in sso74-image-stream.json \
sso74-https.json \
sso74-mysql.json \
sso74-mysql-persistent.json \
sso74-postgresql.json \
sso74-postgresql-persistent.json \
sso74-x509-https.json \
sso74-x509-mysql-persistent.json \
sso74-x509-postgresql-persistent.json
do
oc replace -n openshift --force -f \
https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/v7.4.10.GA/templates/${resource}
done

3. Install the Red Hat Single Sign-On 7.4.10 for OpenShift streams in the
"openshift" project by running the following commands:

$ oc -n openshift import-image redhat-sso74-openshift:1.0

4. Bugs fixed (https://bugzilla.redhat.com/):

2010378 - CVE-2021-3859 undertow: client side invocation timeout raised when calling over HTTP2

5. JIRA issues fixed (https://issues.jboss.org/):

CIAM-1978 - [CVE-2021-3859 (undertow)] RH-SSO 7.4.10 OCP images for OpenJDK

6. References:

https://access.redhat.com/security/cve/CVE-2021-3859
https://access.redhat.com/security/cve/CVE-2022-21248
https://access.redhat.com/security/cve/CVE-2022-21277
https://access.redhat.com/security/cve/CVE-2022-21282
https://access.redhat.com/security/cve/CVE-2022-21283
https://access.redhat.com/security/cve/CVE-2022-21291
https://access.redhat.com/security/cve/CVE-2022-21293
https://access.redhat.com/security/cve/CVE-2022-21294
https://access.redhat.com/security/cve/CVE-2022-21296
https://access.redhat.com/security/cve/CVE-2022-21299
https://access.redhat.com/security/cve/CVE-2022-21305
https://access.redhat.com/security/cve/CVE-2022-21340
https://access.redhat.com/security/cve/CVE-2022-21341
https://access.redhat.com/security/cve/CVE-2022-21360
https://access.redhat.com/security/cve/CVE-2022-21365
https://access.redhat.com/security/cve/CVE-2022-21366
https://access.redhat.com/security/updates/classification/#important

7. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYfq9SdzjgjWX9erEAQi2qRAAimMg6l3xyxXZprTwbU1/r60fIa6uqGjF
x3g2QrZeK5rSe5YfRWzTomfeyLq5FsJul7ZdDYeerjY/g7EPwbZkdkBIbYaxmynB
YJBWHm6R7aO/KfqVchn79yNOQspkNa3HBFzc/UqUa+dw1M3wzDqdRVscb7kr4Gx/
qmHGYwe4EVElOpRSkKSdSgrD6dkfN49Ty5V71fwByfga5FMXpM9loc+6ez+184W2
dRhgwpVFH4e2UldIMj/U9ThedY55IeyJVJpsuANazC6VmxaHzHTy4VvAFz2IXIwU
abbyiyeBZjgdOGKk4jRQga+jAK5mBA+aXx8lSAhw/LuamCzcIyg7TL9qedG2Oeq9
/xRV3NQcAP0aLQYeqWmXJEyaPTNSAHa0x6FWLwaYsLEgYlBrj+4R/WPifoJaDWCj
PBSXdh7rbf/eSGN+3iqcYUrcDfMQbAEQVncYHOw0o6HGN/yL9Unj6AzZVflxthcQ
Lo7sHU+uTrB8oSDhJLCqJttQXkc5CEf/Wiu14pMy1wwYxhsUfbyzEVy59QhsqecZ
j7qMuv6SwSXCSAuEasjItL0omiLHt1ZCCoLcWCqpgo60q7FhOLzflCFkoCM8JNgR
xpT9W697xS2fmJb6xSMHQwEfPNKkZgD77XqRzz0Drcou+A7E0nrfrfMcGNx+gCw3
7X6GIi3KVNU=
=JPbx
-----END PGP SIGNATURE-----