[RHSA-2023:3943-01] Moderate: ACS 4.1 enhancement and security update

Thu Jun 29 15:50:18 UTC 2023

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: ACS 4.1 enhancement and security update
Advisory ID:       RHSA-2023:3943-01
Product:           Red Hat Advanced Cluster Security for Kubernetes
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3943
Issue date:        2023-06-29
CVE Names:         CVE-2020-24736 CVE-2022-27191 CVE-2022-41723 
                   CVE-2023-1667 CVE-2023-2283 CVE-2023-24329 
                   CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 
                   CVE-2023-24538 CVE-2023-26604 CVE-2023-32067 
=====================================================================

1. Summary:

Updated images are now available for Red Hat Advanced Cluster Security
(RHACS). The updated image includes new features and bug fixes.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

The release of ACS 4.1 provides these changes:

Security Fix(es):

* golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK
decoding (CVE-2022-41723)

* golang: net/http, net/textproto: denial of service from excessive memory
allocation (CVE-2023-24534)

* golang: net/http, net/textproto, mime/multipart: denial of service from
excessive resource consumption (CVE-2023-24536)

* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

* golang: html/template: backticks not treated as string delimiters
(CVE-2023-24538)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

New features:

* Manual renewal of Central and Sensor certificates

* Vulnerability Management 2.0 (Technology Preview)

* RHACS Cloud Service scanning support for images pulled from on-premise
registries

* eBPF collection method on IBM Z and IBM® LinuxONE

* Ability to configure the display of default compliance standards in the
Compliance Dashboard

* Declarative configurations for authentication and authorization

* SSO configuration using the roxctl CLI

* New collection method based on BPF CO-RE (Technology Preview)

* Network graph updates

* Policy Management simplification

* New permission sets

* Improvements for Sensor resync (General Availability)

For notable technical changes, deprecated and removed features, bug fixes,
and known issues, refer to the Release Notes.

3. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2064702 - CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server
2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding
2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters
2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation
2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing

5. JIRA issues fixed (https://issues.redhat.com/):

ROX-18018 - Release RHACS 4.1.0

6. References:

https://access.redhat.com/security/cve/CVE-2020-24736
https://access.redhat.com/security/cve/CVE-2022-27191
https://access.redhat.com/security/cve/CVE-2022-41723
https://access.redhat.com/security/cve/CVE-2023-1667
https://access.redhat.com/security/cve/CVE-2023-2283
https://access.redhat.com/security/cve/CVE-2023-24329
https://access.redhat.com/security/cve/CVE-2023-24534
https://access.redhat.com/security/cve/CVE-2023-24536
https://access.redhat.com/security/cve/CVE-2023-24537
https://access.redhat.com/security/cve/CVE-2023-24538
https://access.redhat.com/security/cve/CVE-2023-26604
https://access.redhat.com/security/cve/CVE-2023-32067
https://access.redhat.com/security/updates/classification/#moderate
https://docs.openshift.com/acs/4.1/release_notes/41-release-notes.html

7. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBZJ2oOtzjgjWX9erEAQjwIxAApoKUcr+9BAiimaPNLIjkHntrQFJdGCnj
TuXHF6av+GNIJq3gnrthdccxBprpnVCtWFnApRS+MC0/p9EZdZQron4ZjIRw/BEr
D7Z1LPyk4yaZZtSDKuP5ucwA15I6WlfnwJOzbgyudkcmrgimOsclTmADhR7xHgmJ
ErQFnGaue4PUe1++9Nr5/QxUm23VOgc/zXoWaNXgj6AFo3si3ShxJrWbklctmikz
tmU3rWK+PBXp8+vtjxvMyV9aVn2lcetHolOxIVqydOfzvXsTtU4ikNFpF/dM+w2V
CKRfYtavDua4SXLnTirDOKRullTjpcVoXT7hUkQtuB/dppuHUZamjpQwBw/4xgFf
PHp1zM5A9czhU/ieStkrgL2A002PGI+TSYIBPwbMi+BEKLE+YE/Kn2kPVIBQe4Wd
O8v0IiPZYvPaxpnX7oQtiG/T4EkEEAzeeQco/z9nf8eidP58vJ879xIQfT4vU8Ha
eegIwKt8GyLqv3mNYrkRjKAAmyyc1LuitNZRX9uEu0tjLu4dcLOpYxE+W0II1or2
7dCUW+5rz/rYcEWANzGxt32D7UkIQfIz+J1Z14LaYDbagjzk3lfgqSkDui0ApMGU
Pflee58Bvc+uAYFp0l9J7jXvZeneTmbEVERDH9Xw+KB0GxVcsxQwOQvGbnS8SbmJ
BNeTZbbCSSo=
=sc4W
-----END PGP SIGNATURE-----