[RHSA-2023:1894-01] Critical: Multicluster Engine for Kubernetes 2.1 hotfix security update for console

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: Multicluster Engine for Kubernetes 2.1 hotfix security update for console
Advisory ID:       RHSA-2023:1894-01
Product:           multicluster engine for Kubernetes
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:1894
Issue date:        2023-04-20
CVE Names:         CVE-2023-29017 CVE-2023-29199 CVE-2023-30547 
=====================================================================

1. Summary:

Multicluster Engine for Kubernetes 2.1 hotfix security update for console

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Security Fix(es)

* CVE-2023-29017 vm2: Sandbox Escape
* CVE-2023-29199 vm2: Sandbox Escape
* CVE-2023-30547 vm2: Sandbox Escape when exception sanitization

3. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied, and that you are running
Multicluster Engine for Kubernetes version 2.1.5.

See https://access.redhat.com/solutions/7007647 for instructions on how to
apply this hotfix, as well as for information about when the hotfix has
been
superseded by a permanent fix and should be removed.

Important: This hotfix is a temporary fix that will be supported until 30
days after the date when the next patch release of the product is released.
After the 30-day period ends, you must either update to the latest patch
release and remove this hotfix to continue receiving security updates and
maintain support or upgrade to a newer feature release of the product.

4. Bugs fixed (https://bugzilla.redhat.com/):

2185374 - CVE-2023-29017 vm2: sandbox escape
2187409 - CVE-2023-29199 vm2: Sandbox Escape
2187608 - CVE-2023-30547 vm2: Sandbox Escape when exception sanitization

5. References:

https://access.redhat.com/security/cve/CVE-2023-29017
https://access.redhat.com/security/cve/CVE-2023-29199
https://access.redhat.com/security/cve/CVE-2023-30547
https://access.redhat.com/security/updates/classification/#critical

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBZEgsi9zjgjWX9erEAQjkeRAAkbo9LYGi/zxMSNmwAxThSwdiwysWWY85
Z3GqnSJz9GJVG1Hr1G8cufokeCZZ4PfLk/Et4Ug/97DpGaG548LLe65VTY5p+VhC
0u43Ur+NFARlDqoeCp2+owrDxgd6h78sFJEUC5JF898oZMqTtwqEiBp5aW2dgc3b
X5KxP9IumwGspBvyd9QSLKHCqkxeR2v0t1vDc0kZghJpabbaQyzd6vRaPdCzth9Z
4YjDM7Dox0BA9vgtsjBMOEUm2oJ82zomBQpXPg1HJP47xXk/jsZcQKA1mw+vSKjP
/JuwdOZDuISzHFL3Tb9FLWTKyC3La4WNmSSDvMXsVVlj9kBnKXMpXONcOkr7TZ36
Ws4YMgAbo0Owd0plI+JuwDr/R5sUhPT9FW2P/6h5pnt2F0WfWDTA4QLdUsh/r44q
nMbNMdbIh46x7uYRBUzcoK218qll4Sall3QaR0/Wtn5awx0MNTwIYM8hKj+faM16
/DEhsM1O2dFQy5rE+O79Get403IuWYSC3EKRUcNDgzuxc1g4QeeQzUSL2wAjGelE
2GNOoJgJoh83XhyLiN0tTp8EJPuEs55YIfNt23TCU1kFs7MTqQvQChNIAIyFb8gm
W3/oEBkEGT4JdZ5+RwBk73O3TKfv3NCoAaV/PhBPUzx92FjvTdUQM2rIorSqIRU/
xFEru052XmU=
=UKLU
-----END PGP SIGNATURE-----