[RHSA-2023:5447-01] Important: Migration Toolkit for Containers (MTC) 1.8.0 security and bug fix update

Thu Oct 5 03:27:02 UTC 2023

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Migration Toolkit for Containers (MTC) 1.8.0 security and bug fix update
Advisory ID:       RHSA-2023:5447-01
Product:           Red Hat Migration Toolkit
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:5447
Issue date:        2023-10-05
CVE Names:         CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 
                   CVE-2023-0803 CVE-2023-0804 CVE-2023-2602 
                   CVE-2023-2603 CVE-2023-3899 CVE-2023-4863 
                   CVE-2023-5129 CVE-2023-26115 CVE-2023-27536 
                   CVE-2023-28321 CVE-2023-28484 CVE-2023-29469 
                   CVE-2023-29491 CVE-2023-30630 CVE-2023-32681 
=====================================================================

1. Summary:

The Migration Toolkit for Containers (MTC) 1.8.0 is now available.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

The Migration Toolkit for Containers (MTC) enables you to migrate
Kubernetes resources, persistent volume data, and internal container images
between OpenShift Container Platform clusters, using the MTC web console or
the Kubernetes API.

Security Fix(es):

* word-wrap: ReDoS (CVE-2023-26115)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* MTC version is not displayed correctly in the UI (BZ#2233026)

* Indirect migration is stuck on backup stage (BZ#2233097)

* Migrated application unable to pull image from internal registry on
target cluster (BZ#2233103)

* PodVolumeRestore remain In Progress keeping the migration stuck at Stage
Restore (BZ#2233868)

* Migration failing on Azure due to authorization issue (BZ#2238974)

3. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2216827 - CVE-2023-26115 word-wrap: ReDoS
2233026 - MTC version is not displayed correctly in the UI
2233097 - Indirect migration is stuck on backup stage
2233103 - Migrated application unable to pull image from internal registry on target cluster
2233868 - PodVolumeRestore remain In Progress keeping the migration stuck at Stage Restore
2238974 - Migration failing on Azure due to authorization issue

5. JIRA issues fixed (https://issues.redhat.com/):

MIG-1331 - MTC generates continued requests to Azure Storage API
MIG-1363 - Upgrade OADP dependency to latest version
MIG-1411 - mtc-operator specification is missing related image registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8

6. References:

https://access.redhat.com/security/cve/CVE-2023-0800
https://access.redhat.com/security/cve/CVE-2023-0801
https://access.redhat.com/security/cve/CVE-2023-0802
https://access.redhat.com/security/cve/CVE-2023-0803
https://access.redhat.com/security/cve/CVE-2023-0804
https://access.redhat.com/security/cve/CVE-2023-2602
https://access.redhat.com/security/cve/CVE-2023-2603
https://access.redhat.com/security/cve/CVE-2023-3899
https://access.redhat.com/security/cve/CVE-2023-4863
https://access.redhat.com/security/cve/CVE-2023-5129
https://access.redhat.com/security/cve/CVE-2023-26115
https://access.redhat.com/security/cve/CVE-2023-27536
https://access.redhat.com/security/cve/CVE-2023-28321
https://access.redhat.com/security/cve/CVE-2023-28484
https://access.redhat.com/security/cve/CVE-2023-29469
https://access.redhat.com/security/cve/CVE-2023-29491
https://access.redhat.com/security/cve/CVE-2023-30630
https://access.redhat.com/security/cve/CVE-2023-32681
https://access.redhat.com/security/updates/classification/#important

7. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJlHi0GAAoJENzjgjWX9erEfC8P/2ANhg3OMCWj6UwzdfFFrSYe
l3W2up2XYeC1wBdrJHxZnqwZal65z+9XVoUliHEQeSqq3RE70Yi0l33DzyGSSchM
W86n4LrG77uNDtdpbFxJw3/VCaxLaBJJYafxnmgHmjAM71kQTCT8EwBuMF+tNi6j
NLIlxK2LU+w72nSqdXxp84mjkSJkmUf+NfD6x8sWhnrEc8ylAQDvhEAniVrbnWEP
i1Yy/9CAf4xyvtGrzU+vnL+Ec/i5dRv8bByOjmWpLhnmadZLGOxjW09Yok1vZtp2
ZjstfmZDZBWsaydS1PV6whMrtVUrwk3as/E5JJMH8b3cMjwsgFUKwjNCeI9xsbxw
rSQRTjvGqhDJgqZl7gIOLQMW/TaVSiBOWZ/Op1ffFt8BbhbQi3MCwaCN84/1RGaD
ovCfqkxjhlbi2JxOCJLZ/pP9jrMlsvCBmTeqhRI7II8uTdz3NEtC9KDVWBQqMWjR
eUg9uHD583sak/xiQVELKmgtdJBSeQokrKWmrC7exYlQMb1ZFBHibgEYfTl6zESt
9+LCzQ4opzhEcjaoSfHwiaD2qjpwk3NN3tWFY01I0xZ3nBXNbShigXzUtTMr4waF
vHVKyjJurZVkcwgBS8czrcCjwZKRtfE1zJapVyuAn6roGR6acxv9p2y5npzZVWQo
HfsLprN666qJ0q8C1j5b
=5w8O
-----END PGP SIGNATURE-----