RedHat: RHSA-2021-1324:01 Important: Red Hat OpenShift Service Mesh...

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat OpenShift Service Mesh 2.0.3 security update
Advisory ID:       RHSA-2021:1324-01
Product:           Red Hat OpenShift Service Mesh
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:1324
Issue date:        2021-04-22
CVE Names:         CVE-2021-28682 CVE-2021-28683 CVE-2021-29258 
=====================================================================

1. Summary:

An update for servicemesh-proxy is now available for OpenShift Service Mesh
2.0.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

2.0 - ppc64le, s390x, x86_64

3. Description:

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio
service mesh project, tailored for installation into an on-premise
OpenShift Container Platform installation.

Security Fix(es):

* envoyproxy/envoy: integer overflow handling large grpc-timeouts
(CVE-2021-28682)

* envoyproxy/envoy: NULL pointer dereference in TLS alert code handling
(CVE-2021-28683)

* envoyproxy/envoy: crash with empty HTTP/2 metadata map (CVE-2021-29258)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1942263 - CVE-2021-28683 envoyproxy/envoy: NULL pointer dereference in TLS alert code handling
1942272 - CVE-2021-28682 envoyproxy/envoy: integer overflow handling large grpc-timeouts
1942280 - CVE-2021-29258 envoyproxy/envoy: crash with empty HTTP/2 metadata map

6. Package List:

2.0:

Source:
servicemesh-proxy-2.0.3-1.el8.src.rpm

ppc64le:
servicemesh-proxy-2.0.3-1.el8.ppc64le.rpm

s390x:
servicemesh-proxy-2.0.3-1.el8.s390x.rpm

x86_64:
servicemesh-proxy-2.0.3-1.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-28682
https://access.redhat.com/security/cve/CVE-2021-28683
https://access.redhat.com/security/cve/CVE-2021-29258
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYIE7XtzjgjWX9erEAQi9VA//VR6ZxZQROcCvTHcDlFzAKJUt89yCG/7F
Khs+XFmHuAnPaHW2s85vaJYPPGj7mVrKAZwc999bTbVw1yCtnCKnhTYgb27nx7QI
jQph7nLrFdOiXDw0tnJk6QeGxwsZJU5kdOy03f5aNMLfNU398Q4bV5X4XywdiGtC
V1X9uZzPlpfVWnJO7F32gp0egmVr7PZpsd/EDnlSTuqXBW0cFP5uaIceUclMtAMt
ZaXBGENBieA5KP3xlkoNH9+cgxARVSrmm6H9BqlOrbd1f3KleSHN3b+YMk/RqoZ9
RyTgiYhOOpa296A8EiFQXx00imv87AlIoSy9szCCIs079rB+eZpYIgBt0IeZokMM
/SvIC8hMrFH886xBuBFK21S1iShc4ZuPjfHunmMCABAbKEJU0S52u7t2Nth3u4Ri
OPIfpuyR5vnWrA3BaI5NZn/VTG16Pw43ZH3AJyZSFW9Z5ZwYL2F86vxzU2momUUk
oeDFPPGcMVuVQtGe6lFpkpt7az8BaqzWtbGzWkgicsBMGKmtXeZFVOjQmHIGun/d
mGi23/acHNAk8kqxzl0PjG2Rq3C9/htKZpB3Pr5uGxHcdn5JQlKakQwucmEY3KXy
ENagT82q1t9VX0srAL4W4Qe4nPEeYzh12MpenJpo8shYIqx0u/U8leaShJEFw3yy
XrXzX4971yg=
=33Dt
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2021-1324:01 Important: Red Hat OpenShift Service Mesh 2.0.3

An update for servicemesh-proxy is now available for OpenShift Service Mesh 2.0

Summary

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
Security Fix(es):
* envoyproxy/envoy: integer overflow handling large grpc-timeouts (CVE-2021-28682)
* envoyproxy/envoy: NULL pointer dereference in TLS alert code handling (CVE-2021-28683)
* envoyproxy/envoy: crash with empty HTTP/2 metadata map (CVE-2021-29258)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2021-28682 https://access.redhat.com/security/cve/CVE-2021-28683 https://access.redhat.com/security/cve/CVE-2021-29258 https://access.redhat.com/security/updates/classification/#important

Package List

2.0:
Source: servicemesh-proxy-2.0.3-1.el8.src.rpm
ppc64le: servicemesh-proxy-2.0.3-1.el8.ppc64le.rpm
s390x: servicemesh-proxy-2.0.3-1.el8.s390x.rpm
x86_64: servicemesh-proxy-2.0.3-1.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2021:1324-01
Product: Red Hat OpenShift Service Mesh
Advisory URL: https://access.redhat.com/errata/RHSA-2021:1324
Issued Date: : 2021-04-22
CVE Names: CVE-2021-28682 CVE-2021-28683 CVE-2021-29258

Topic

An update for servicemesh-proxy is now available for OpenShift Service Mesh2.0.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Relevant Releases Architectures

2.0 - ppc64le, s390x, x86_64

Bugs Fixed

1942263 - CVE-2021-28683 envoyproxy/envoy: NULL pointer dereference in TLS alert code handling

1942272 - CVE-2021-28682 envoyproxy/envoy: integer overflow handling large grpc-timeouts

1942280 - CVE-2021-29258 envoyproxy/envoy: crash with empty HTTP/2 metadata map

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.