[RHSA-2023:4875-01] Critical: Red Hat Advanced Cluster Management 2.8.1 security and bug fix updates

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: Red Hat Advanced Cluster Management 2.8.1 security and bug fix updates
Advisory ID:       RHSA-2023:4875-01
Product:           Red Hat ACM
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4875
Issue date:        2023-08-30
CVE Names:         CVE-2020-24736 CVE-2023-1667 CVE-2023-2283 
                   CVE-2023-2602 CVE-2023-2603 CVE-2023-3027 
                   CVE-2023-3089 CVE-2023-3899 CVE-2023-24329 
                   CVE-2023-26604 CVE-2023-27536 CVE-2023-28321 
                   CVE-2023-28484 CVE-2023-29469 CVE-2023-32681 
                   CVE-2023-34969 CVE-2023-37466 CVE-2023-37903 
                   CVE-2023-38408 
=====================================================================

1. Summary:

Red Hat Advanced Cluster Management for Kubernetes 2.8.1 General
Availability release images, which provide security updates and fix bugs.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE links in the References section.

2. Description:

Red Hat Advanced Cluster Management for Kubernetes 2.8.1 images

Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which provide security updates and fix several
bugs. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.8/html/release_notes/

Security fix(es):
* CVE-2023-3089 - openshift: OCP & FIPS mode
* CVE-2023-37903 - vm2: custom inspect function allows attackers to escape
the sandbox and run arbitrary code
* CVE-2023-37466 - vm2: Promise handler sanitization can be bypassed
allowing attackers to escape the sandbox and run arbitrary code
* CVE-2023-3027 - ACM: governance policy propagator privilege escalation

3. Solution:

For information and instructions for these updates, see the following
article: https://access.redhat.com/solutions/7022540.

For Red Hat Advanced Cluster Management for Kubernetes, see the following
documentation, which will be updated shortly for this release, for
important
instructions on installing this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.8/html-single/install/index#installing

4. Bugs fixed (https://bugzilla.redhat.com/):

2211468 - CVE-2023-3027 ACM: governance policy propagator privilege escalation
2212085 - CVE-2023-3089 openshift: OCP & FIPS mode
2224969 - CVE-2023-37903 vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code
2232376 - CVE-2023-37466 vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code

5. References:

https://access.redhat.com/security/cve/CVE-2020-24736
https://access.redhat.com/security/cve/CVE-2023-1667
https://access.redhat.com/security/cve/CVE-2023-2283
https://access.redhat.com/security/cve/CVE-2023-2602
https://access.redhat.com/security/cve/CVE-2023-2603
https://access.redhat.com/security/cve/CVE-2023-3027
https://access.redhat.com/security/cve/CVE-2023-3089
https://access.redhat.com/security/cve/CVE-2023-3899
https://access.redhat.com/security/cve/CVE-2023-24329
https://access.redhat.com/security/cve/CVE-2023-26604
https://access.redhat.com/security/cve/CVE-2023-27536
https://access.redhat.com/security/cve/CVE-2023-28321
https://access.redhat.com/security/cve/CVE-2023-28484
https://access.redhat.com/security/cve/CVE-2023-29469
https://access.redhat.com/security/cve/CVE-2023-32681
https://access.redhat.com/security/cve/CVE-2023-34969
https://access.redhat.com/security/cve/CVE-2023-37466
https://access.redhat.com/security/cve/CVE-2023-37903
https://access.redhat.com/security/cve/CVE-2023-38408
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/RHSB-2023-001

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJk71bEAAoJENzjgjWX9erEfB8QAJs8e6iJGQX2i0QYRabaZ7tN
pIwg6E1lSTz44XBBbJzLjaUSa6oPyRFBJIOWiPzpbMALIgj8IjuartxH6IuYHVqZ
RUmoDjAkt8KftV2VZ7v4Gy/qFOTAy/o+l7boq1C6JZ01wBDOYwKo4SI5m0t/dwPh
l8a7mDfKD9uQeGjr/F9nbSB9l4CS3dVVzQOycaPu9FdpizYfD2ZlDjmwMoIiqf0I
tqNRFy241LeYTyc2G9AtUFxUp4DO9psS5+aFf+3jLWVLFT5AnAykN1RWCbwi8Hdl
l2TSuwOEJVW2xxGqpHuuxgeyrnhjLZKWEaJagujx1q643eC7aVYnzVXeIhe860/E
7hgriIERBQ2AuI2mfizoMTLjVsoxfJ2F+dfSQr35WJ04G2V+5BrBEvuCwANzy9e5
/b4jKb7r777f6JrlGy+yasCQS1gIWmObf7VBL0GYBxrePxBbFIrCEfJJgkfq5dM6
yX+YCiwq3c/XfUIoR8FrSOrfL1X1W4MVbB/0tLMJyTZzIij7xx2m6HkMwxkB5T42
OfOlAstohLS06gW+Fwi92bmOYk/PKLc/+izyqJTZRfb6NnayWL6ycVRngXfdibBU
wabn0eZp+JSqp5LO/tchkAGjBDqy2WXMpOx2kl8eQ4jQv2hoU52U2q6bxmF2W96G
kVOx0vxaOxzTVHciE92T
=I0do
-----END PGP SIGNATURE-----