RedHat: RHSA-2021-3556:01 Moderate: Release of OpenShift Serverless...

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Release of OpenShift Serverless 1.17.0
Advisory ID:       RHSA-2021:3556-01
Product:           Red Hat OpenShift Serverless
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:3556
Issue date:        2021-09-16
CVE Names:         CVE-2016-10228 CVE-2017-14502 CVE-2019-2708 
                   CVE-2019-9169 CVE-2019-25013 CVE-2020-8231 
                   CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 
                   CVE-2020-8927 CVE-2020-13434 CVE-2020-15358 
                   CVE-2020-27618 CVE-2020-28196 CVE-2020-29361 
                   CVE-2020-29362 CVE-2020-29363 CVE-2021-3326 
                   CVE-2021-3421 CVE-2021-3449 CVE-2021-3450 
                   CVE-2021-3516 CVE-2021-3517 CVE-2021-3518 
                   CVE-2021-3520 CVE-2021-3537 CVE-2021-3541 
                   CVE-2021-3703 CVE-2021-20271 CVE-2021-20305 
                   CVE-2021-27218 CVE-2021-27918 CVE-2021-31525 
                   CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 
                   CVE-2021-33198 CVE-2021-34558 
=====================================================================

1. Summary:

Release of OpenShift Serverless 1.17.0

Red Hat Product Security has rated this update as having a security impact
of
Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE
link(s) in the References section.

2. Description:

Red Hat OpenShift Serverless 1.17.0 release of the OpenShift Serverless
Operator. This version of the OpenShift Serverless Operator is supported on
Red Hat OpenShift Container Platform versions 4.6, 4.7 and 4.8, and
includes security and bug fixes and enhancements. For more information, see
the documentation listed in the References section.

Security Fix(es):

* golang: crypto/tls: certificate of wrong type is causing TLS client to
panic
(CVE-2021-34558)
* golang: net: lookup functions may return invalid host names
(CVE-2021-33195)
* golang: net/http/httputil: ReverseProxy forwards connection headers if
first one is empty (CVE-2021-33197)
* golang: match/big.Rat: may cause a panic or an unrecoverable fatal error
if passed inputs with very large exponents (CVE-2021-33198)
* golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a
custom TokenReader (CVE-2021-27918)
* golang: net/https: panic in ReadRequest and ReadResponse when reading a
very large header (CVE-2021-31525)
* golang: archive/zip: malformed archive may cause panic or memory
exhaustion (CVE-2021-33196)

It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196
have been incorrectly mentioned as fixed in RHSA for Serverless client kn
1.16.0. This has been fixed (CVE-2021-3703).

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

See the Red Hat OpenShift Container Platform 4.6 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/
4.6/html/serverless/index
See the Red Hat OpenShift Container Platform 4.7 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/
4.7/html/serverless/index
See the Red Hat OpenShift Container Platform 4.8 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/
4.8/html/serverless/index

4. Bugs fixed (https://bugzilla.redhat.com/):

1983596 - CVE-2021-34558 golang: crypto/tls: certificate of wrong type is causing TLS client to panic
1983651 - Release of OpenShift Serverless Serving 1.17.0
1983654 - Release of OpenShift Serverless Eventing 1.17.0
1989564 - CVE-2021-33195 golang: net: lookup functions may return invalid host names
1989570 - CVE-2021-33197 golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty
1989575 - CVE-2021-33198 golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents
1992955 - CVE-2021-3703 serverless: incomplete fix for CVE-2021-27918 / CVE-2021-31525 / CVE-2021-33196

5. References:

https://access.redhat.com/security/cve/CVE-2016-10228
https://access.redhat.com/security/cve/CVE-2017-14502
https://access.redhat.com/security/cve/CVE-2019-2708
https://access.redhat.com/security/cve/CVE-2019-9169
https://access.redhat.com/security/cve/CVE-2019-25013
https://access.redhat.com/security/cve/CVE-2020-8231
https://access.redhat.com/security/cve/CVE-2020-8284
https://access.redhat.com/security/cve/CVE-2020-8285
https://access.redhat.com/security/cve/CVE-2020-8286
https://access.redhat.com/security/cve/CVE-2020-8927
https://access.redhat.com/security/cve/CVE-2020-13434
https://access.redhat.com/security/cve/CVE-2020-15358
https://access.redhat.com/security/cve/CVE-2020-27618
https://access.redhat.com/security/cve/CVE-2020-28196
https://access.redhat.com/security/cve/CVE-2020-29361
https://access.redhat.com/security/cve/CVE-2020-29362
https://access.redhat.com/security/cve/CVE-2020-29363
https://access.redhat.com/security/cve/CVE-2021-3326
https://access.redhat.com/security/cve/CVE-2021-3421
https://access.redhat.com/security/cve/CVE-2021-3449
https://access.redhat.com/security/cve/CVE-2021-3450
https://access.redhat.com/security/cve/CVE-2021-3516
https://access.redhat.com/security/cve/CVE-2021-3517
https://access.redhat.com/security/cve/CVE-2021-3518
https://access.redhat.com/security/cve/CVE-2021-3520
https://access.redhat.com/security/cve/CVE-2021-3537
https://access.redhat.com/security/cve/CVE-2021-3541
https://access.redhat.com/security/cve/CVE-2021-3703
https://access.redhat.com/security/cve/CVE-2021-20271
https://access.redhat.com/security/cve/CVE-2021-20305
https://access.redhat.com/security/cve/CVE-2021-27218
https://access.redhat.com/security/cve/CVE-2021-27918
https://access.redhat.com/security/cve/CVE-2021-31525
https://access.redhat.com/security/cve/CVE-2021-33195
https://access.redhat.com/security/cve/CVE-2021-33196
https://access.redhat.com/security/cve/CVE-2021-33197
https://access.redhat.com/security/cve/CVE-2021-33198
https://access.redhat.com/security/cve/CVE-2021-34558
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYUOQNtzjgjWX9erEAQgfrA//WVhFv3NmzNhqlaxh6WdgsRxc1GFoOHis
BNHlHLCZcozHybe2Pfj1QWEZy3W933Dqt1oWcCQ79AIQ7xITAv4Y68uGq4nUJIlk
aF9NFkS12xnJSSAGLeeJQC+dJ57r1sTixA2C4fkGQmSveTgNuLqHEdM2/0vDI2+U
Zu5Hx9OWaodPhqko8jlapfP5TWMviWg4mztKiM2Io01VsQrKIMUoWE2pAN5TZlrB
Fo3HNghEJwibQL7nWqekz9Lx0Rud9jl/mOEUy0TQFmW+IOX4hxa0alQtLxVAdFf0
L8Yc9xQxGUV7wjlnWKyPCaoCRHZ4sRVxW1Ybdbc2IbAZG0iy8a024EBtpKgZpBbl
xpEItn7P6+a3cQWybAP4qcqgIB6e3VseQoqDgnwVHUFx62/A9MxqOUw/3g5IQVRv
sTLXMMCDb6vsMhostUaF5R2tuWGscezqcU6PTkoHYof0W28HGIhA1LrCCrRlrqcm
SC36nHginXnhpANi45zkRgJYhz764fzTcR2q73nAHh9353SuDdoEGZKxrjAc6s09
Rz6qoFsCK22arV8Nv5qTNHUvYH8v7/GYG6PWeaju+C7XoB7F3vrRlYkCDbkowlJS
WfgovLxNTNqYB2JP6V2mPDSW2gSBqdohcYMDVmZ9zJSNbkcF5yRBLrKt2TmvrvmJ
2SHG1JoPDMg=
=a+6D
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2021-3556:01 Moderate: Release of OpenShift Serverless 1.17.0

Release of OpenShift Serverless 1.17.0 Red Hat Product Security has rated this update as having a security impact of Moderate

Summary

Red Hat OpenShift Serverless 1.17.0 release of the OpenShift Serverless Operator. This version of the OpenShift Serverless Operator is supported on Red Hat OpenShift Container Platform versions 4.6, 4.7 and 4.8, and includes security and bug fixes and enhancements. For more information, see the documentation listed in the References section.
Security Fix(es):
* golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558) * golang: net: lookup functions may return invalid host names (CVE-2021-33195) * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197) * golang: match/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198) * golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader (CVE-2021-27918) * golang: net/https: panic in ReadRequest and ReadResponse when reading a very large header (CVE-2021-31525) * golang: archive/zip: malformed archive may cause panic or memory exhaustion (CVE-2021-33196)
It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless client kn 1.16.0. This has been fixed (CVE-2021-3703).
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

See the Red Hat OpenShift Container Platform 4.6 documentation at:https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/indexSee the Red Hat OpenShift Container Platform 4.7 documentation at:https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/indexSee the Red Hat OpenShift Container Platform 4.8 documentation at:https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index

References

https://access.redhat.com/security/cve/CVE-2016-10228 https://access.redhat.com/security/cve/CVE-2017-14502 https://access.redhat.com/security/cve/CVE-2019-2708 https://access.redhat.com/security/cve/CVE-2019-9169 https://access.redhat.com/security/cve/CVE-2019-25013 https://access.redhat.com/security/cve/CVE-2020-8231 https://access.redhat.com/security/cve/CVE-2020-8284 https://access.redhat.com/security/cve/CVE-2020-8285 https://access.redhat.com/security/cve/CVE-2020-8286 https://access.redhat.com/security/cve/CVE-2020-8927 https://access.redhat.com/security/cve/CVE-2020-13434 https://access.redhat.com/security/cve/CVE-2020-15358 https://access.redhat.com/security/cve/CVE-2020-27618 https://access.redhat.com/security/cve/CVE-2020-28196 https://access.redhat.com/security/cve/CVE-2020-29361 https://access.redhat.com/security/cve/CVE-2020-29362 https://access.redhat.com/security/cve/CVE-2020-29363 https://access.redhat.com/security/cve/CVE-2021-3326 https://access.redhat.com/security/cve/CVE-2021-3421 https://access.redhat.com/security/cve/CVE-2021-3449 https://access.redhat.com/security/cve/CVE-2021-3450 https://access.redhat.com/security/cve/CVE-2021-3516 https://access.redhat.com/security/cve/CVE-2021-3517 https://access.redhat.com/security/cve/CVE-2021-3518 https://access.redhat.com/security/cve/CVE-2021-3520 https://access.redhat.com/security/cve/CVE-2021-3537 https://access.redhat.com/security/cve/CVE-2021-3541 https://access.redhat.com/security/cve/CVE-2021-3703 https://access.redhat.com/security/cve/CVE-2021-20271 https://access.redhat.com/security/cve/CVE-2021-20305 https://access.redhat.com/security/cve/CVE-2021-27218 https://access.redhat.com/security/cve/CVE-2021-27918 https://access.redhat.com/security/cve/CVE-2021-31525 https://access.redhat.com/security/cve/CVE-2021-33195 https://access.redhat.com/security/cve/CVE-2021-33196 https://access.redhat.com/security/cve/CVE-2021-33197 https://access.redhat.com/security/cve/CVE-2021-33198 https://access.redhat.com/security/cve/CVE-2021-34558 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index

Package List

Severity
Advisory ID: RHSA-2021:3556-01
Product: Red Hat OpenShift Serverless
Advisory URL: https://access.redhat.com/errata/RHSA-2021:3556
Issued Date: : 2021-09-16
CVE Names: CVE-2016-10228 CVE-2017-14502 CVE-2019-2708 CVE-2019-9169 CVE-2019-25013 CVE-2020-8231 CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 CVE-2020-8927 CVE-2020-13434 CVE-2020-15358 CVE-2020-27618 CVE-2020-28196 CVE-2020-29361 CVE-2020-29362 CVE-2020-29363 CVE-2021-3326 CVE-2021-3421 CVE-2021-3449 CVE-2021-3450 CVE-2021-3516 CVE-2021-3517 CVE-2021-3518 CVE-2021-3520 CVE-2021-3537 CVE-2021-3541 CVE-2021-3703 CVE-2021-20271 CVE-2021-20305 CVE-2021-27218 CVE-2021-27918 CVE-2021-31525 CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198 CVE-2021-34558

Topic

Release of OpenShift Serverless 1.17.0Red Hat Product Security has rated this update as having a security impactofModerate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVElink(s) in the References section.

Relevant Releases Architectures

Bugs Fixed

1983596 - CVE-2021-34558 golang: crypto/tls: certificate of wrong type is causing TLS client to panic

1983651 - Release of OpenShift Serverless Serving 1.17.0

1983654 - Release of OpenShift Serverless Eventing 1.17.0

1989564 - CVE-2021-33195 golang: net: lookup functions may return invalid host names

1989570 - CVE-2021-33197 golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty

1989575 - CVE-2021-33198 golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents

1992955 - CVE-2021-3703 serverless: incomplete fix for CVE-2021-27918 / CVE-2021-31525 / CVE-2021-33196

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.