RedHat: RHSA-2021-2763:01 Important: OpenShift Container Platform 4.7.21
Summary
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
The kernel packages contain the Linux kernel, the core of any Linux
operating system.
The kernel-rt packages provide the Real Time Linux Kernel, which enables
fine-tuning for systems with extremely high determinism requirements.
Ansible is a SSH-based configuration management, deployment, and task
execution system. The openshift-ansible packages contain Ansible code and
playbooks for installing and upgrading OpenShift Container Platform 3.
The systemd packages contain systemd, a system and service manager for
Linux, compatible with the SysV and LSB init scripts. It provides
aggressive parallelism capabilities, uses socket and D-Bus activation for
starting services, offers on-demand starting of daemons, and keeps track of
processes using Linux cgroups. In addition, it supports snapshotting and
restoring of the system state, maintains mount and automount points, and
implements an elaborate transactional dependency-based service control
logic. It can also work as a drop-in replacement for sysvinit.
Security Fix(es):
* kernel: size_t-to-int conversion vulnerability in the filesystem layer
(CVE-2021-33909)
* systemd: uncontrolled allocation on the stack in function
unit_name_path_escape leads to crash (CVE-2021-33910)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
* kernel-rt: update RT source tree to the RHEL-8.3.z source tree
(BZ#1957359)
* Placeholder bug for OCP 4.7.0 rpm release (BZ#1983534)
Summary
Solution
For OpenShift Container Platform 4.7 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:
https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html
Details on how to access this content are available at
- -cli.html
The system must be rebooted for this update to take effect.
References
https://access.redhat.com/security/cve/CVE-2021-33909 https://access.redhat.com/security/cve/CVE-2021-33910 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/RHSB-2021-006
Package List
Red Hat OpenShift Container Platform 4.7:
Source:
cri-o-1.20.4-4.rhaos4.7.gitf7276ed.el7.src.rpm
openshift-4.7.0-202107132131.p0.git.558d959.assembly.stream.el7.src.rpm
openshift-ansible-4.7.0-202107070256.p0.git.e1b19c2.assembly.stream.el7.src.rpm
openshift-clients-4.7.0-202107070256.p0.git.8b4b094.assembly.stream.el7.src.rpm
noarch:
openshift-ansible-4.7.0-202107070256.p0.git.e1b19c2.assembly.stream.el7.noarch.rpm
openshift-ansible-test-4.7.0-202107070256.p0.git.e1b19c2.assembly.stream.el7.noarch.rpm
x86_64:
cri-o-1.20.4-4.rhaos4.7.gitf7276ed.el7.x86_64.rpm
cri-o-debuginfo-1.20.4-4.rhaos4.7.gitf7276ed.el7.x86_64.rpm
openshift-clients-4.7.0-202107070256.p0.git.8b4b094.assembly.stream.el7.x86_64.rpm
openshift-clients-redistributable-4.7.0-202107070256.p0.git.8b4b094.assembly.stream.el7.x86_64.rpm
openshift-hyperkube-4.7.0-202107132131.p0.git.558d959.assembly.stream.el7.x86_64.rpm
Red Hat OpenShift Container Platform 4.7:
Source:
atomic-openshift-service-idler-4.7.0-202107070256.p0.git.39cfc66.assembly.stream.el8.src.rpm
cri-o-1.20.4-4.rhaos4.7.gitf7276ed.el8.src.rpm
kernel-4.18.0-240.23.2.el8_3.src.rpm
kernel-rt-4.18.0-240.23.2.rt7.79.el8_3.src.rpm
openshift-4.7.0-202107132131.p0.git.558d959.assembly.stream.el8.src.rpm
openshift-clients-4.7.0-202107070256.p0.git.8b4b094.assembly.stream.el8.src.rpm
openshift-kuryr-4.7.0-202107070256.p0.git.c7654fb.assembly.stream.el8.src.rpm
systemd-239-41.el8_3.3.src.rpm
noarch:
kernel-abi-whitelists-4.18.0-240.23.2.el8_3.noarch.rpm
kernel-doc-4.18.0-240.23.2.el8_3.noarch.rpm
openshift-kuryr-cni-4.7.0-202107070256.p0.git.c7654fb.assembly.stream.el8.noarch.rpm
openshift-kuryr-common-4.7.0-202107070256.p0.git.c7654fb.assembly.stream.el8.noarch.rpm
openshift-kuryr-controller-4.7.0-202107070256.p0.git.c7654fb.assembly.stream.el8.noarch.rpm
python3-kuryr-kubernetes-4.7.0-202107070256.p0.git.c7654fb.assembly.stream.el8.noarch.rpm
ppc64le:
atomic-openshift-service-idler-4.7.0-202107070256.p0.git.39cfc66.assembly.stream.el8.ppc64le.rpm
bpftool-4.18.0-240.23.2.el8_3.ppc64le.rpm
bpftool-debuginfo-4.18.0-240.23.2.el8_3.ppc64le.rpm
cri-o-1.20.4-4.rhaos4.7.gitf7276ed.el8.ppc64le.rpm
cri-o-debuginfo-1.20.4-4.rhaos4.7.gitf7276ed.el8.ppc64le.rpm
cri-o-debugsource-1.20.4-4.rhaos4.7.gitf7276ed.el8.ppc64le.rpm
kernel-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-core-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-cross-headers-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-debug-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-debug-core-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-debug-debuginfo-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-debug-devel-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-debug-modules-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-debug-modules-extra-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-debug-modules-internal-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-debuginfo-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-debuginfo-common-ppc64le-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-devel-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-headers-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-ipaclones-internal-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-modules-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-modules-extra-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-modules-internal-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-selftests-internal-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-tools-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-tools-debuginfo-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-tools-libs-4.18.0-240.23.2.el8_3.ppc64le.rpm
kernel-tools-libs-devel-4.18.0-240.23.2.el8_3.ppc64le.rpm
openshift-clients-4.7.0-202107070256.p0.git.8b4b094.assembly.stream.el8.ppc64le.rpm
openshift-hyperkube-4.7.0-202107132131.p0.git.558d959.assembly.stream.el8.ppc64le.rpm
perf-4.18.0-240.23.2.el8_3.ppc64le.rpm
perf-debuginfo-4.18.0-240.23.2.el8_3.ppc64le.rpm
python3-perf-4.18.0-240.23.2.el8_3.ppc64le.rpm
python3-perf-debuginfo-4.18.0-240.23.2.el8_3.ppc64le.rpm
s390x:
atomic-openshift-service-idler-4.7.0-202107070256.p0.git.39cfc66.assembly.stream.el8.s390x.rpm
bpftool-4.18.0-240.23.2.el8_3.s390x.rpm
bpftool-debuginfo-4.18.0-240.23.2.el8_3.s390x.rpm
cri-o-1.20.4-4.rhaos4.7.gitf7276ed.el8.s390x.rpm
cri-o-debuginfo-1.20.4-4.rhaos4.7.gitf7276ed.el8.s390x.rpm
cri-o-debugsource-1.20.4-4.rhaos4.7.gitf7276ed.el8.s390x.rpm
kernel-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-core-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-cross-headers-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-debug-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-debug-core-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-debug-debuginfo-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-debug-devel-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-debug-modules-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-debug-modules-extra-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-debug-modules-internal-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-debuginfo-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-debuginfo-common-s390x-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-devel-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-headers-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-modules-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-modules-extra-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-modules-internal-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-selftests-internal-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-tools-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-tools-debuginfo-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-zfcpdump-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-zfcpdump-core-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-zfcpdump-debuginfo-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-zfcpdump-devel-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-zfcpdump-modules-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-zfcpdump-modules-extra-4.18.0-240.23.2.el8_3.s390x.rpm
kernel-zfcpdump-modules-internal-4.18.0-240.23.2.el8_3.s390x.rpm
openshift-clients-4.7.0-202107070256.p0.git.8b4b094.assembly.stream.el8.s390x.rpm
openshift-hyperkube-4.7.0-202107132131.p0.git.558d959.assembly.stream.el8.s390x.rpm
perf-4.18.0-240.23.2.el8_3.s390x.rpm
perf-debuginfo-4.18.0-240.23.2.el8_3.s390x.rpm
python3-perf-4.18.0-240.23.2.el8_3.s390x.rpm
python3-perf-debuginfo-4.18.0-240.23.2.el8_3.s390x.rpm
x86_64:
atomic-openshift-service-idler-4.7.0-202107070256.p0.git.39cfc66.assembly.stream.el8.x86_64.rpm
bpftool-4.18.0-240.23.2.el8_3.x86_64.rpm
bpftool-debuginfo-4.18.0-240.23.2.el8_3.x86_64.rpm
cri-o-1.20.4-4.rhaos4.7.gitf7276ed.el8.x86_64.rpm
cri-o-debuginfo-1.20.4-4.rhaos4.7.gitf7276ed.el8.x86_64.rpm
cri-o-debugsource-1.20.4-4.rhaos4.7.gitf7276ed.el8.x86_64.rpm
kernel-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-core-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-cross-headers-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-debug-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-debug-core-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-debug-debuginfo-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-debug-devel-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-debug-modules-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-debug-modules-extra-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-debug-modules-internal-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-debuginfo-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-debuginfo-common-x86_64-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-devel-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-headers-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-ipaclones-internal-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-modules-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-modules-extra-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-modules-internal-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-rt-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-core-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-debug-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-debug-core-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-debug-debuginfo-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-debug-devel-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-debug-kvm-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-debug-modules-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-debug-modules-extra-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-debug-modules-internal-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-debuginfo-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-debuginfo-common-x86_64-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-devel-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-kvm-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-modules-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-modules-extra-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-modules-internal-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-rt-selftests-internal-4.18.0-240.23.2.rt7.79.el8_3.x86_64.rpm
kernel-selftests-internal-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-tools-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-tools-debuginfo-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-tools-libs-4.18.0-240.23.2.el8_3.x86_64.rpm
kernel-tools-libs-devel-4.18.0-240.23.2.el8_3.x86_64.rpm
openshift-clients-4.7.0-202107070256.p0.git.8b4b094.assembly.stream.el8.x86_64.rpm
openshift-clients-redistributable-4.7.0-202107070256.p0.git.8b4b094.assembly.stream.el8.x86_64.rpm
openshift-hyperkube-4.7.0-202107132131.p0.git.558d959.assembly.stream.el8.x86_64.rpm
perf-4.18.0-240.23.2.el8_3.x86_64.rpm
perf-debuginfo-4.18.0-240.23.2.el8_3.x86_64.rpm
python3-perf-4.18.0-240.23.2.el8_3.x86_64.rpm
python3-perf-debuginfo-4.18.0-240.23.2.el8_3.x86_64.rpm
systemd-239-41.el8_3.3.x86_64.rpm
systemd-container-239-41.el8_3.3.x86_64.rpm
systemd-container-debuginfo-239-41.el8_3.3.x86_64.rpm
systemd-debuginfo-239-41.el8_3.3.x86_64.rpm
systemd-debugsource-239-41.el8_3.3.x86_64.rpm
systemd-devel-239-41.el8_3.3.x86_64.rpm
systemd-journal-remote-239-41.el8_3.3.x86_64.rpm
systemd-journal-remote-debuginfo-239-41.el8_3.3.x86_64.rpm
systemd-libs-239-41.el8_3.3.x86_64.rpm
systemd-libs-debuginfo-239-41.el8_3.3.x86_64.rpm
systemd-pam-239-41.el8_3.3.x86_64.rpm
systemd-pam-debuginfo-239-41.el8_3.3.x86_64.rpm
systemd-tests-239-41.el8_3.3.x86_64.rpm
systemd-tests-debuginfo-239-41.el8_3.3.x86_64.rpm
systemd-udev-239-41.el8_3.3.x86_64.rpm
systemd-udev-debuginfo-239-41.el8_3.3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
An update is now available for Red Hat OpenShift Container Platform 4.7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Red Hat OpenShift Container Platform 4.7 - noarch, ppc64le, s390x, x86_64
Bugs Fixed
1970273 - CVE-2021-33909 kernel: size_t-to-int conversion vulnerability in the filesystem layer
1970887 - CVE-2021-33910 systemd: uncontrolled allocation on the stack in function unit_name_path_escape leads to crash
1983534 - Placeholder bug for OCP 4.7.0 rpm release