[RHSA-2023:4335-01] Important: Security Update for cert-manager Operator for Red Hat OpenShift 1.10.3

Tue Aug 8 02:19:32 UTC 2023

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Security Update for cert-manager Operator for Red Hat OpenShift 1.10.3
Advisory ID:       RHSA-2023:4335-01
Product:           Cert Manager support for Red Hat OpenShift
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4335
Issue date:        2023-08-08
CVE Names:         CVE-2022-28805 CVE-2022-36227 CVE-2022-41723 
                   CVE-2022-41724 CVE-2022-41725 CVE-2023-0464 
                   CVE-2023-0465 CVE-2023-0466 CVE-2023-1255 
                   CVE-2023-2650 CVE-2023-24534 CVE-2023-24536 
                   CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 
                   CVE-2023-24540 CVE-2023-27535 CVE-2023-29400 
=====================================================================

1. Summary:

cert-manager Operator for Red Hat OpenShift 1.10.3

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

The cert-manager Operator for Red Hat OpenShift builds on top of
Kubernetes, introducing certificate authorities
and certificates as first-class resource types in the Kubernetes API. This
makes it possible to provide
certificates-as-a-service to developers working within your Kubernetes
cluster.

Security Fix(es):

* golang: html/template: improper handling of JavaScript whitespace
(CVE-2023-24540)
* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK
decoding (CVE-2022-41723)
* golang: crypto/tls: large handshake records may cause panics
(CVE-2022-41724)
* golang: net/http, mime/multipart: denial of service from excessive
resource consumption (CVE-2022-41725)
* golang: net/http, net/textproto: denial of service from excessive memory
allocation (CVE-2023-24534)
* golang: net/http, net/textproto, mime/multipart: denial of service from
excessive resource consumption (CVE-2023-24536)
* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
* golang: html/template: backticks not treated as string delimiters
(CVE-2023-24538)
* golang: html/template: improper sanitization of CSS values
(CVE-2023-24539)
* golang: html/template: improper handling of empty HTML attributes
(CVE-2023-29400)

3. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding
2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption
2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics
2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters
2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation
2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing
2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values
2196027 - CVE-2023-24540 golang: html/template: improper handling of JavaScript whitespace
2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes

5. References:

https://access.redhat.com/security/cve/CVE-2022-28805
https://access.redhat.com/security/cve/CVE-2022-36227
https://access.redhat.com/security/cve/CVE-2022-41723
https://access.redhat.com/security/cve/CVE-2022-41724
https://access.redhat.com/security/cve/CVE-2022-41725
https://access.redhat.com/security/cve/CVE-2023-0464
https://access.redhat.com/security/cve/CVE-2023-0465
https://access.redhat.com/security/cve/CVE-2023-0466
https://access.redhat.com/security/cve/CVE-2023-1255
https://access.redhat.com/security/cve/CVE-2023-2650
https://access.redhat.com/security/cve/CVE-2023-24534
https://access.redhat.com/security/cve/CVE-2023-24536
https://access.redhat.com/security/cve/CVE-2023-24537
https://access.redhat.com/security/cve/CVE-2023-24538
https://access.redhat.com/security/cve/CVE-2023-24539
https://access.redhat.com/security/cve/CVE-2023-24540
https://access.redhat.com/security/cve/CVE-2023-27535
https://access.redhat.com/security/cve/CVE-2023-29400
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJk0aY0AAoJENzjgjWX9erEW4gP/jwOmHUpW2LNa7WU1w+F6mee
o2jRC9JiRFHhntunHzsaaHNgNeDiAGn434nODJX5xBIa164eFhlEyw41SCrCIJWO
7U+qjjmAAWMLuq40v8xhgOX0TD4lN2duoQQ/FSnzJ0Xrv72os2Qv57t3D1tBF2l+
J0Z5oha+VX+Xjxwbuf9/u8Iv9VbgJYk8f6kKHyMwm9Ch4IPT+GN8K886/B52y7E+
Urw1ZwhfRecfZCXakiCCimdSSVGSDTcDjMVL0PRj5XAbhqpoO5PdzLB7hIvqkw5/
m0mN6Eqf/FzA4oJKxQyapJtcRBlX3djdWGYCBFeKCkyTxTAlYQdHmrqKLuGHCvWz
dRU2sPfV14DVMf7AfOpZF2u4/q9snZmfqewyQNlx+k2vlcYQwt+OW9VxbWrHIFrx
XSGaZq+OulogJYe8Ti3eotF71sBg8UvSvt5KvhChKrrt3UM4qyE46Cc55TTwTRoE
b7BcAlwpvdDX33vcEUdBRUz/9kz5PRw+YK6Lg52m3o0CLEVPHCcCP/pFJEXeRS2A
bbwDNFdEyjERaEI88iiGTbf8Q9SGvW4XtzrPrWjaF6IbBMuJxKdOGdOcfRCYOHHt
FDRlr4DQLA4HX8iBKQbF9kyBUzkTak/1bSPYS80YDZfAWgYmENhYUmFp1Syaf1OP
Eu+Wd3TxRaMlfZqDwMgq
=cK0Q
-----END PGP SIGNATURE-----