[RHSA-2022:0997-01] Moderate: Red Hat OpenStack Platform 16.2 (golang-qpid-apache) security update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack Platform 16.2 (golang-qpid-apache) security update
Advisory ID:       RHSA-2022:0997-01
Product:           Red Hat OpenStack Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:0997
Issue date:        2022-03-23
CVE Names:         CVE-2021-29923 
=====================================================================

1. Summary:

An update for golang-qpid-apache is now available for Red Hat OpenStack
Platform 16.2 (Train).

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.2 - ppc64le, x86_64

3. Description:

Golang binding library for qpid-proton

Security Fix(es):

* net: incorrect parsing of extraneous zero characters at the beginning of
an IP address octet (CVE-2021-29923)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1992006 - CVE-2021-29923 golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

6. Package List:

Red Hat OpenStack Platform 16.2:

Source:
golang-qpid-apache-0.32.0-rc1.9.el8ost.src.rpm

ppc64le:
golang-qpid-apache-0.32.0-rc1.9.el8ost.ppc64le.rpm

x86_64:
golang-qpid-apache-0.32.0-rc1.9.el8ost.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-29923
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYjvl0NzjgjWX9erEAQg1mg/9H+k4Bv8RoAUuNlR7+FcyFqvWJFl/siYZ
ayrWWClh725tlzYBMu1kX6solT8cDAFBA2r0spcAEUsIq7AxdoeSja3JjRRl0mww
EvkhuSnFqCDOpb8OQWKPgxid7GZgXoQM29ki59l7QSvF8QapWKEvgEvfqLuB/ZY8
ijm4wM7St5tVTgrirjUw/z/d2+McXKIH1ooRKoVEtZHR2NTUmN7C6ps2QcrJR0qg
7kT0ParP4VlDDw/RTin8zpq8jB4emQAkBkDV6XMiHdTtziEojhwGYJ0hlOnXEgy6
y3g7DjLFaMFyvjaJ359XuC/OWJBhPhjiHM9G7iZMOEn+pEANDFYQsC3SXiqnvGox
pmBdVbrGtA2FLm47c7rGYjnFsV7Qtm4xgQNxmMffIMG75Oeo8W95xpglUNpuqKim
B4lC+pZwbBxPSy5tr0S8uAJpOEsB+aCemIsqsn8GiOdz0Hrh2zNThFQBSvHEqs2c
Xyp0/IzDKmmXaRRdzwPD3rIIAp3tTMzEoK+E1gzBeoBeCKJwAJplgQjqqvaclBc0
/0iuPO2HWvoEy98RNLSYkS/I7WSe8IUM4j3Jm/Ng5AMY2t/KuASe7chB25psx/Ln
jtWiXx+7bZ1JjUP/a9ojIyN4BKTFqBXWPotrR8CCia3z1SCDV2zATZnPryCydOlG
Rt08PYNGRos=
=Ky/6
-----END PGP SIGNATURE-----