[RHSA-2022:2281-01] Moderate: OpenShift Container Platform 3.11.705 security update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: OpenShift Container Platform 3.11.705 security update
Advisory ID:       RHSA-2022:2281-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:2281
Issue date:        2022-05-31
CVE Names:         CVE-2018-25032 CVE-2022-1271 CVE-2022-1677 
                   CVE-2022-21426 CVE-2022-21434 CVE-2022-21443 
                   CVE-2022-21476 CVE-2022-21496 CVE-2022-21698 
                   CVE-2022-29036 CVE-2022-29046 CVE-2022-29599 
=====================================================================

1. Summary:

Red Hat OpenShift Container Platform release 3.11.705 is now available with
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container
Platform 3.11.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 3.11.705. See the following advisory for the RPM packages for this
release:

https://access.redhat.com/errata/RHSA-2022:2280

Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp-3-11-release-notes.html

Security Fix(es):

* openshift/router: route hijacking attack via crafted HAProxy
configuration file (CVE-2022-1677)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.

3. Solution:

For OpenShift Container Platform 3.11 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/3.11/upgrading/index.html

4. Bugs fixed (https://bugzilla.redhat.com/):

2076211 - CVE-2022-1677 openshift/router: route hijacking attack via crafted HAProxy configuration file
2086938 - Placeholder bug for OCP 3.11.z image release

5. References:

https://access.redhat.com/security/cve/CVE-2018-25032
https://access.redhat.com/security/cve/CVE-2022-1271
https://access.redhat.com/security/cve/CVE-2022-1677
https://access.redhat.com/security/cve/CVE-2022-21426
https://access.redhat.com/security/cve/CVE-2022-21434
https://access.redhat.com/security/cve/CVE-2022-21443
https://access.redhat.com/security/cve/CVE-2022-21476
https://access.redhat.com/security/cve/CVE-2022-21496
https://access.redhat.com/security/cve/CVE-2022-21698
https://access.redhat.com/security/cve/CVE-2022-29036
https://access.redhat.com/security/cve/CVE-2022-29046
https://access.redhat.com/security/cve/CVE-2022-29599
https://access.redhat.com/security/updates/classification/#moderate

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYpYjptzjgjWX9erEAQgU8g/8C/b0KCGsh0xLI3l6ShAaJibDJ1XyplL0
5NvgtdukOIi1TF3o3HI3Fy8tM7arDpXUSuf/fGW6Bk/+mud8OIbl7cJFBJq9aVDw
eoDovnWkbiSMtegakiCazmhtF5N0diSIj8oKYbBx3hccZ2wJl7XpZgJaQbsz5A0d
gQdYKx/Jnrhj48FCMlKk5VbEfP76Cm3TtSdkAralvRUKrv3kKFc7e6Jyjl/9+YpN
FkqGJHlbpvKetBLZGMJOaMcXlcOb27sbURdJrRYoLLCphz0sR7MCV30rPmqSdq5F
9my92ABfaQ9ODGsn3YIG5qL8S6ZE4X/wjM+rIwV7C5NGzC8UQVwi8DdRZp0cm4qA
o0DWb6dXXwIAOCJz08qShb0wP4gAf4PIrfcm4fcK6JdtRkVJ5FSbQS1KXysE/cPw
maiJ6MF5R1vQRyrDe1g3+m3DsVgyeQcmKZSrH8lYaTqS8TSeieiuNOQjLJcqDmXi
3O5v+vgSYJv1K/V9E6rzvc3w4fE2C1FjOL0wCTfvVMv7SdfgrV6UEV4Gf2LD4GtR
icLhnTAKTqw0A817U2A3gKPKdRA2+c75s5YM6cXW8Arv3Mzt+nkHTdPJnUtoZwNb
vFZDIY/LXi/5b0VIyU3AQpjTIPoHAfT+P9wqB9xgG1OGatzZIdnnOk1T37U7S2Ou
Xg7Lxx50JNQ=
=DTk8
-----END PGP SIGNATURE-----