[RHSA-2023:1448-01] Moderate: Red Hat OpenShift Service Mesh Containers for 2.3.2 security update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenShift Service Mesh Containers for 2.3.2 security update
Advisory ID:       RHSA-2023:1448-01
Product:           RHOSSM
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:1448
Issue date:        2023-03-23
CVE Names:         CVE-2020-10735 CVE-2021-28861 CVE-2021-46848 
                   CVE-2022-4415 CVE-2022-35737 CVE-2022-40303 
                   CVE-2022-40304 CVE-2022-40897 CVE-2022-41717 
                   CVE-2022-42010 CVE-2022-42011 CVE-2022-42012 
                   CVE-2022-43680 CVE-2022-45061 CVE-2022-47629 
                   CVE-2022-48303 CVE-2023-23916 
=====================================================================

1. Summary:

Red Hat OpenShift Service Mesh Containers for 2.3.2

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Service Mesh is the Red Hat distribution of the Istio
service mesh project, tailored for installation into an on-premise
OpenShift Container Platform installation.

This advisory covers container images for the release.

Security Fix(es):

* golang: net/http: An attacker can cause excessive memory growth in a Go
server accepting HTTP/2 requests (CVE-2022-41717)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2161274 - CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests

5. JIRA issues fixed (https://issues.jboss.org/):

OSSM-1330 - Allow specifying secret as pilot server cert when using CertificateAuthority: Custom
OSSM-2342 - Run OSSM operator on infrastructure nodes
OSSM-2371 - Kiali in read-only mode still can change the log level of the envoy proxies
OSSM-2373 - Can't login to Kiali with "Error trying to get OAuth metadata"
OSSM-2374 - Deleting a SMM also deletes the SMMR in OpenShift Service Mesh
OSSM-2492 - Default tolerations in SMCP not passed to Jaeger
OSSM-2493 - Default nodeSelector and tolerations in SMCP not passed to Kiali
OSSM-3317 - Error: deployment.accessible_namespaces set to ['**']

6. References:

https://access.redhat.com/security/cve/CVE-2020-10735
https://access.redhat.com/security/cve/CVE-2021-28861
https://access.redhat.com/security/cve/CVE-2021-46848
https://access.redhat.com/security/cve/CVE-2022-4415
https://access.redhat.com/security/cve/CVE-2022-35737
https://access.redhat.com/security/cve/CVE-2022-40303
https://access.redhat.com/security/cve/CVE-2022-40304
https://access.redhat.com/security/cve/CVE-2022-40897
https://access.redhat.com/security/cve/CVE-2022-41717
https://access.redhat.com/security/cve/CVE-2022-42010
https://access.redhat.com/security/cve/CVE-2022-42011
https://access.redhat.com/security/cve/CVE-2022-42012
https://access.redhat.com/security/cve/CVE-2022-43680
https://access.redhat.com/security/cve/CVE-2022-45061
https://access.redhat.com/security/cve/CVE-2022-47629
https://access.redhat.com/security/cve/CVE-2022-48303
https://access.redhat.com/security/cve/CVE-2023-23916
https://access.redhat.com/security/updates/classification/#moderate

7. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBZBzBgdzjgjWX9erEAQg+RA//U81YTWP1rgG9WS9tC680BqAEEIPxsu+m
EYKP0RuNAIRQ2I75GKo3V6NPanherwNzJLOlf4rbfcYH+YtrMWvTDlo+BRZ4vqiK
+LsWBg79XkcJKq2er7NJ9ZJsz2PYiEHVhUdLmlg5aVvi1AJMSfimVxvNTKPR39LU
r/dUsF3uThlY3jcaSsix0CiawOtS8pfV9xKx4wUtbI1HoKHOODjRIz34AZEdldP+
TSxILtPstiAw4LsEWUBPcGd0LSAtA8apMa8c5Hqtr8Sv0EaF1HRqp2jF1JvI/YIF
3o7nW9POMOCl+6MHHQ5RSHKdGwj8NDtkCwIgGoaMLE4KeTIWyA82V7Scx51Hkcpj
eBj1bPI7HPwglage6XM/gVJrGy5RucGL7HRQjYa3e+g7az3rtT0cVGdIKUXEiNaF
t3oBrvQWFCvjpc/9zRdWX48H+S1rPz67enUvpAnMT4/xh4+4A50LZXOD7rzlScy7
yKw2ZuSqvEd8IQDwNGvL1syS45QVda0DkiWDgJBu0I9JMFAZsklwqE2EHmWtP455
iTZF+ihoEKNH/OACDLYYYqWqCEhav7YTXcVsoF7jb5fM2cJyfHjdBWnqDhUQTSS1
5N5uptv3bCSo/fwbvr1SXFUto4Gpt/G2fPHH2pTm2FKg9GRgJRpzQFZyg5L69UDG
fLr0RtMPl5A=
=B2kJ
-----END PGP SIGNATURE-----