[RHSA-2023:5480-01] Important: Release of OpenShift Serverless Logic 1.30.0 SP1 security update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Release of OpenShift Serverless Logic 1.30.0 SP1 security update
Advisory ID:       RHSA-2023:5480-01
Product:           Red Hat OpenShift Serverless
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:5480
Issue date:        2023-10-05
CVE Names:         CVE-2023-2602 CVE-2023-2603 CVE-2023-4853 
                   CVE-2023-22006 CVE-2023-22036 CVE-2023-22041 
                   CVE-2023-22044 CVE-2023-22045 CVE-2023-22049 
                   CVE-2023-25193 CVE-2023-27536 CVE-2023-28321 
                   CVE-2023-28484 CVE-2023-29469 CVE-2023-29491 
                   CVE-2023-34969 
=====================================================================

1. Summary:

Release of OpenShift Serverless Operator 1.30.1 and OpenShift Serverless
Logic 1.30.0 SP1

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE links in the References section.

2. Description:

Red Hat OpenShift Serverless release of OpenShift Serverless Logic.

This release includes security fixes.

Security Fix(es):

* quarkus: HTTP security policy bypass (CVE-2023-4853)

For further information about CVE-2023-4853, see the Red Hat Security
Bulletin link in the References section.

For more details about the security issues, including the impact, a CVSS
score, acknowledgements, and other related information, refer to the CVE
pages listed in the References section.

3. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2238034 - CVE-2023-4853 quarkus: HTTP security policy bypass

5. References:

https://access.redhat.com/security/cve/CVE-2023-2602
https://access.redhat.com/security/cve/CVE-2023-2603
https://access.redhat.com/security/cve/CVE-2023-4853
https://access.redhat.com/security/cve/CVE-2023-22006
https://access.redhat.com/security/cve/CVE-2023-22036
https://access.redhat.com/security/cve/CVE-2023-22041
https://access.redhat.com/security/cve/CVE-2023-22044
https://access.redhat.com/security/cve/CVE-2023-22045
https://access.redhat.com/security/cve/CVE-2023-22049
https://access.redhat.com/security/cve/CVE-2023-25193
https://access.redhat.com/security/cve/CVE-2023-27536
https://access.redhat.com/security/cve/CVE-2023-28321
https://access.redhat.com/security/cve/CVE-2023-28484
https://access.redhat.com/security/cve/CVE-2023-29469
https://access.redhat.com/security/cve/CVE-2023-29491
https://access.redhat.com/security/cve/CVE-2023-34969
https://access.redhat.com/security/vulnerabilities/RHSB-2023-002
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html/serverless/index
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.12/html/serverless/index
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/serverless/index

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJlHypBAAoJENzjgjWX9erEKGkP/jYGGRUGra0tizCgOISt3wpS
YKNeBdag+cSMriReV9XSse2/SYWd0CXtynbDZfQYyP7EmXik03/7Rf/o5h92OJ4c
jxrJF4mCmc0dFW31HEefguylonyMKp75XFZb0+hnAaFU4BfjzNIw8DpOcF3JP7Q7
revr5B95oWRHcfG/Wy+9g0texu7ilFlYR5Hp3eYbntkstfpOMIYHjnvYF7fDN9Ty
4AG6aAUnR0UOT5rEZE9GtGaeK+MIMbR8bnjud+NcCuYXktnGNTMhUxEa8uguh7pM
Q7hG+n6cAOYKb3kGkhCMwrfRE0TrFgkbQ0r4PoFsWll6TEV5UdBRDE5KCnUxBDjU
9CweYlI1veEx/dfpR17bOgtik6RaRsku3mUp4+3Arp8i5MMUFCWC20oyi382T/NA
EpkehRCOJk0PWgYsZ8jvPlJqgitgrpN4rIyljN4utTxFlTyZlVJyYLXPcRg0/N3t
4gFaIFqtrgumLmfgrMe6/PqmA8mRcZENsZiDeoB/zxdOGLZ4lJpgZt2/gOjONWkL
A6P+XhzLfp5BVUf4HCua2pQnk/W96ooKabsvhTc1kGb7z8f09JuNxLTIiaj+m7Jt
EMwqNxjH3hpoRF2XfOvVR0IM/G26siMpxHkqof9YA8I/St2HDpCKFn7B/ofQRMni
9J9AvIfhEJHOpvztziJH
=zYgu
-----END PGP SIGNATURE-----