[RHSA-2022:6345-01] Moderate: Multicluster Engine for Kubernetes 2.1 security updates and bug fixes

Security announcements for all Red Hat products and services. rhsa-announce at redhat.com
Tue Sep 6 16:28:44 UTC 2022 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Multicluster Engine for Kubernetes 2.1 security updates and bug fixes
Advisory ID:       RHSA-2022:6345-01
Product:           multicluster engine for Kubernetes
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6345
Issue date:        2022-09-06
CVE Names:         CVE-2022-1292 CVE-2022-1586 CVE-2022-1705 
                   CVE-2022-1962 CVE-2022-2068 CVE-2022-2097 
                   CVE-2022-2526 CVE-2022-28131 CVE-2022-29154 
                   CVE-2022-30629 CVE-2022-30630 CVE-2022-30631 
                   CVE-2022-30632 CVE-2022-30633 CVE-2022-30635 
                   CVE-2022-31129 CVE-2022-32148 CVE-2022-32206 
                   CVE-2022-32208 
=====================================================================

1. Summary:

Multicluster Engine v2.1

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Multicluster engine for Kubernetes 2.1 images

Multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.

You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.

Security fixes:

* CVE-2022-31129 moment: inefficient parsing algorithm resulting in DoS

* CVE-2022-1705 golang: net/http: improper sanitization of
Transfer-Encoding header

* CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions

* CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip

* CVE-2022-30630 golang: io/fs: stack exhaustion in Glob

* CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read

* CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob

* CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal

* CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode

* CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy -
omit X-Forwarded-For not working

* CVE-2022-30629 golang: crypto/tls: session tickets lack random
ticket_age_add

Bug fixes:

* MCE 2.1.0 Images (BZ# 2090907)

* cluster-proxy-agent not able to startup (BZ# 2109394)

* Create cluster button skips Infrastructure page, shows blank page (BZ#
2110713)

* AWS Icon sometimes doesn't show up in create cluster wizard (BZ# 2110734)

* Infrastructure descriptions in create cluster catalog should be
consistent and clear (BZ# 2110811)

* The user with clusterset view permission should not able to update the
namespace binding with the pencil icon on clusterset details page (BZ#
2111483)

* hypershift cluster creation -> not all agent labels are shown in the node
pools screen (BZ# 2112326)

* CIM - SNO expansion, worker node status incorrect (BZ# 2114735)

* Wizard fields are not pre-filled after picking credentials (BZ# 2117163)

* ManagedClusterImageRegistry CR is wrong in pure MCE env

3. Solution:

For multicluster engine for Kubernetes, see the following documentation for
details on how to install the images:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/multicluster_engine/install_upgrade/installing-while-connected-online-mce

4. Bugs fixed (https://bugzilla.redhat.com/):

2090907 - MCE 2.1.0 Images
2092793 - CVE-2022-30629 golang: crypto/tls: session tickets lack random ticket_age_add
2105075 - CVE-2022-31129 moment: inefficient parsing algorithm resulting in DoS
2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
2107371 - CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
2107374 - CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
2107376 - CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
2107383 - CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
2107386 - CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
2107388 - CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode
2107390 - CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
2107392 - CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal
2109394 - cluster-proxy-agent not able to startup
2111483 - The user with clusterset view permission should not able to update the namespace binding with the pencil icon on clusterset details page
2112326 - [UI] hypershift cluster creation -> not all agent labels are shown in the node pools screen
2114735 - [UI] CIM - SNO expansion, worker node status incorrect
2117163 - [UI] Wizard fields are not pre-filled after picking credentials
2117447 - [ACM 2.6] ManagedClusterImageRegistry CR is wrong in pure MCE env

5. References:

https://access.redhat.com/security/cve/CVE-2022-1292
https://access.redhat.com/security/cve/CVE-2022-1586
https://access.redhat.com/security/cve/CVE-2022-1705
https://access.redhat.com/security/cve/CVE-2022-1962
https://access.redhat.com/security/cve/CVE-2022-2068
https://access.redhat.com/security/cve/CVE-2022-2097
https://access.redhat.com/security/cve/CVE-2022-2526
https://access.redhat.com/security/cve/CVE-2022-28131
https://access.redhat.com/security/cve/CVE-2022-29154
https://access.redhat.com/security/cve/CVE-2022-30629
https://access.redhat.com/security/cve/CVE-2022-30630
https://access.redhat.com/security/cve/CVE-2022-30631
https://access.redhat.com/security/cve/CVE-2022-30632
https://access.redhat.com/security/cve/CVE-2022-30633
https://access.redhat.com/security/cve/CVE-2022-30635
https://access.redhat.com/security/cve/CVE-2022-31129
https://access.redhat.com/security/cve/CVE-2022-32148
https://access.redhat.com/security/cve/CVE-2022-32206
https://access.redhat.com/security/cve/CVE-2022-32208
https://access.redhat.com/security/updates/classification/#moderate

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYxd1PNzjgjWX9erEAQh7HA//fT5iA3HhDII5vYRpRaOLoXR2cczIDvlC
WV6jZ4or3aPhJVrr+SI2HVNOLyFXcHswnuwbESf0IKUQcV1DfeCp5spuenYRaBv9
Sl3aho5eNriBhttGYovshlMSEwhfIYeRO5tHRe0cmr30e/UKf81oUFKR+4I7Ub3P
nANV5JX2xMj2vXZR9jD/hHPu6m+3q9dQisNGXv3vXhyxGgeOVzVNg8fKt9KyE5sY
rbx5a5FcIvkxkePY18JqJdJbNR/bkxJFsLX0N0koJR1OPyyvzZxq03vaPJksJQIp
cpuYVW5zA1jYH9LkOh//BJyM+uYrpDDs+e0SzGOKloXmSJ7jN8P9jfGQo/3wRV1i
8QityhTmb9Or5abE3czeqYdTLxIssLkpxNOnPpdYuhVxK/NXCRvrtGpwb1Uqn5NI
mw2kiIvFW3751GwwzxGau/8cwF9XoJZHsm9G9CaGexqgZV0p6ZqXybH1dr3MqQix
57QYFgX3jwJt516dBibxARKAAeVYnAuLH5y21NyA8zhBtTT+26qgWKWxme7FQJFM
fBIF/yopoWDZCMw4mkznupMFP5soixuYVBz9X3ftIBbYuJ3Y5fjQfaiUi/zi0B+c
maBncWDxlVu0p4vtwNZx3fk6QxP0uaRFJdJY91fSW0JFoaDa8NVBwXkw7aBIPbMX
Da5a/9G9+eU=
=oVuT
-----END PGP SIGNATURE-----

More information about the RHSA-announce mailing list