Red Hat OpenShift 4.8.4 RHSA-2021-2983-01 Moderate Security Update
red hat
August 10, 2021
Red Hat OpenShift Container Platform release 4.8.4 is now available with updates to packages and images that fix several bugs and add enhancements
Solution
For OpenShift Container Platform 4.8 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.8/html/release_notes/ocp-4-8-release-notes
Details on how to access this content are available at
- -cli.html
Summary
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container
Platform 4.8.4. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHSA-2021:2984
Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.8/html/release_notes/ocp-4-8-release-notes
Security Fix(es):
* golang: net/http: panic in ReadRequest and ReadResponse when reading a
very large header (CVE-2021-31525)
* golang: net: lookup functions may return invalid host names
(CVE-2021-33195)
* golang: archive/zip: Malformed archive may cause panic or memory
exhaustion (CVE-2021-33196)
* golang: net/http/httputil: ReverseProxy forwards connection headers if
first one is empty (CVE-2021-33197)
* golang: math/big.Rat: may cause a panic or an unrecoverable fatal error
if passed inputs with very large exponents (CVE-2021-33198)
* golang: crypto/tls: certificate of wrong type is causing TLS client to
panic (CVE-2021-34558)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
You may download the oc tool and use it to inspect release image metadata
as follows:
(For x86_64 architecture)
$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.8.4-x86_64
The image digest is
sha256:841535acc09ca8412cd17e8f7702eceda1cac688ccc281278f108675c30de270
(For s390x architecture)
$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.8.4-s390x
The image digest is
sha256:78945f4ccc4c1c7fa57762f49e63b1b0e004a0026f6efa85c0a459c777fcead1
(For ppc64le architecture)
$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.8.4-ppc64le
The image digest is
sha256:ad3da79ce274c6460a3b50551c54a1eb32562c5a5cec5129cb76c018b8b4dcbb
All OpenShift Container Platform 4.8 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift Console
or the CLI oc command. Instructions for upgrading a cluster are available
at
- -between-minor.html#understanding-upgrade-channels_updating-cluster-between
- -minor
References
https://access.redhat.com/security/cve/CVE-2021-31525 https://access.redhat.com/security/cve/CVE-2021-33195 https://access.redhat.com/security/cve/CVE-2021-33196 https://access.redhat.com/security/cve/CVE-2021-33197 https://access.redhat.com/security/cve/CVE-2021-33198 https://access.redhat.com/security/cve/CVE-2021-34558 https://access.redhat.com/security/updates/classification/#moderate
Package List
PREVIOUS
NEXT
Advisory ID: RHSA-2021:2983-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2021:2983
Issue date: 2021-08-10
Topic
Red Hat OpenShift Container Platform release 4.8.4 is now available withupdates to packages and images that fix several bugs and add enhancements.This release includes a security update for Red Hat OpenShift ContainerPlatform 4.8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Relevant Releases Architectures
Bugs Fixed
1938967 - Updating baremetal-machine-controller builder & base images to be consistent with ART
1943565 - ThanosSidecarUnhealthy
1947809 - Upgrade tests should skip disruption tests on single node clusters1948021 - e2e should fail if operators set unexpected Upgradeable post install
1948629 - Add "none" / "minimal" upgrade test suites to skip disruption tests
1957222 - Add internal option for registry info
1957512 - minor regression in openshift-tests command-line options
1958341 - CVE-2021-31525 golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header
1960446 - nmstate operator doesn't handle nodes with taints
1961057 - [Driver: Gluster] tests failing in IPv6 and IPv4v6
1965503 - CVE-2021-33196 golang: archive/zip: malformed archive may cause panic or memory exhaustion
1967949 - (release-4.8) records data size is incorrectly growing when obfuscation is enabled or when there are duplicated records
1971730 - 503 Error page contains license for a vulnerable release of Bootstrap
1972478 - OLM: Failure alert message for copied CSV not helpful
1973662 - Image pruner does not use custom tolerations
1974812 - In customize create vm wizard, a warning "no registred model"
1975559 - typo in operators available
1976008 - Get invalid date when edit custom time range on monitoring dashboards
1976349 - Missing policy-group label on the openshift-console namespace manifest
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!