[RHSA-2023:5442-01] Moderate: Red Hat Advanced Cluster Management 2.8.2 security and bug fix updates

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Advanced Cluster Management 2.8.2 security and bug fix updates
Advisory ID:       RHSA-2023:5442-01
Product:           Red Hat ACM
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:5442
Issue date:        2023-10-04
CVE Names:         CVE-2022-41721 CVE-2023-24539 CVE-2023-24540 
                   CVE-2023-26136 CVE-2023-29400 CVE-2023-29491 
                   CVE-2023-30630 
=====================================================================

1. Summary:

Red Hat Advanced Cluster Management for Kubernetes 2.8.2 General
Availability release images, which provide security updates and fix bugs.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE links in the References section.

2. Description:

Red Hat Advanced Cluster Management for Kubernetes 2.8.2 images

Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which fix several bugs. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.8/html/release_notes/

Jira issues resolved: 

* ACM-5398: ACM ignores Policies about empty label/field

* ACM-6003: UI throws "ClusterSets failed to load" error while deploying
application set based applications from console

* ACM-6171: Policy shows as "Compliant" despite there being violations

Security fix(es):
* CVE-2023-26136 tough-cookie: prototype pollution in cookie memstore
* CVE-2022-41721 x/net/http2/h2c: request smuggling
* CVE-2023-24539 html/template: improper sanitization of CSS values
* CVE-2023-24540 html/template: improper handling of JavaScript whitespace
* CVE-2023-29400 html/template: improper handling of empty HTML attributes

3. Solution:

For Red Hat Advanced Cluster Management for Kubernetes, see the following
documentation, which will be updated shortly for this release, for
important
instructions on installing this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.8/html-single/install/index#installing

4. Bugs fixed (https://bugzilla.redhat.com/):

2162182 - CVE-2022-41721 x/net/http2/h2c: request smuggling
2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values
2196027 - CVE-2023-24540 golang: html/template: improper handling of JavaScript whitespace
2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes
2219310 - CVE-2023-26136 tough-cookie: prototype pollution in cookie memstore

5. JIRA issues fixed (https://issues.redhat.com/):

ACM-5398 - ACM ignores Policies about empty label/field
ACM-6003 - UI throws "ClusterSets failed to load" error while deploying application set based applications from console
ACM-6171 - [2.8] Policy shows as "Compliant" despite there being violations

6. References:

https://access.redhat.com/security/cve/CVE-2022-41721
https://access.redhat.com/security/cve/CVE-2023-24539
https://access.redhat.com/security/cve/CVE-2023-24540
https://access.redhat.com/security/cve/CVE-2023-26136
https://access.redhat.com/security/cve/CVE-2023-29400
https://access.redhat.com/security/cve/CVE-2023-29491
https://access.redhat.com/security/cve/CVE-2023-30630
https://access.redhat.com/security/updates/classification/#moderate

7. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJlHYRqAAoJENzjgjWX9erEcnEQAJxyd3E3iFa5Bk3uA434vusY
D8TJ9BxMv+RNaiceuPums4MaaZ3xU08URdX0B2FComyk7DHFSb/DvbISX3jnfF5+
eytlan7Iwh7RR1xNKoi4VnGmWFZOlEc7gaCHJNmvRQp0s3cV91qsfT3lgL5MsBN0
PjHJrO0v+9FRg2BedEsHjoZwPkch1nqSe3CPISmF9IuudjqFEymObDZURBEbJ/MD
OUOeJE5piBfWuWXzq+k7UIFYW8sCDi8vNXD2Jxjs9gHPAQu09N2rHoXAH6Uwe/W2
2gtVbUDfwZL41OfpkCrsRRp8/Ff/598ke9WF6fiiRNmQ1oSDVu4k/up6/475DuoS
yFPShbKvtWOKN3hBCR3+3uJbbMOylKYHRZGS66grxIC0CNcQ/lwhdsmy0dTp8WPL
eedwMaLtGgLmhl/p4rpH/G6DVg7Exo1PbAOQbwr6xj5t0gF98VjLiF/x2gFk9Ppx
uwzNshW2c+MI3eL7LKgjH3GWcYUVjq9CGnokxWDUbpzvf6CJtTj72KPhuLtI7DPp
Zn+fdvo+YjZOFV64mwHKi6A/sj7Lg2GaAh2PQenmeRGY/fD50vkDefWTvdcROkyY
LeJXn/5zEUFfkeHwwxb6A6rLB5P5u1pfyVHUxUuj4z9ariyixNyvVY3jdqWsA+MH
WPZLdvY2VTluMXrnTymY
=FTVh
-----END PGP SIGNATURE-----