Red Hat OpenShift 4.9.0 Advisory RHSA-2021:4104-01 Moderate Threats
red hat
November 2, 2021
Red Hat OpenShift Virtualization release 4.9.0 is now available with updates to packages and images that fix several bugs and add enhancements
Solution
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
Summary
OpenShift Virtualization is Red Hat's virtualization solution designed for
Red Hat OpenShift Container Platform.
This advisory contains the following OpenShift Virtualization 4.9.0 images:
RHEL-8-CNV-4.9
=============kubevirt-v2v-conversion-container-v4.9.0-9
vm-import-controller-container-v4.9.0-15
cnv-containernetworking-plugins-container-v4.9.0-15
kubemacpool-container-v4.9.0-18
virtio-win-container-v4.9.0-8
vm-import-operator-container-v4.9.0-15
kubevirt-vmware-container-v4.9.0-8
kubevirt-template-validator-container-v4.9.0-14
cluster-network-addons-operator-container-v4.9.0-26
kubernetes-nmstate-handler-container-v4.9.0-25
node-maintenance-operator-container-v4.9.0-13
hostpath-provisioner-container-v4.9.0-6
bridge-marker-container-v4.9.0-13
kubevirt-ssp-operator-container-v4.9.0-28
ovs-cni-marker-container-v4.9.0-16
ovs-cni-plugin-container-v4.9.0-16
vm-import-virtv2v-container-v4.9.0-15
virt-cdi-apiserver-container-v4.9.0-35
virt-cdi-cloner-container-v4.9.0-35
virt-cdi-uploadproxy-container-v4.9.0-35
virt-cdi-controller-container-v4.9.0-35
hostpath-provisioner-operator-container-v4.9.0-15
virt-cdi-importer-container-v4.9.0-35
virt-cdi-uploadserver-container-v4.9.0-35
virt-cdi-operator-container-v4.9.0-35
virt-launcher-container-v4.9.0-58
virt-api-container-v4.9.0-58
virt-handler-container-v4.9.0-58
virt-operator-container-v4.9.0-58
virt-controller-container-v4.9.0-58
virt-artifacts-server-container-v4.9.0-58
libguestfs-tools-container-v4.9.0-58
cnv-must-gather-container-v4.9.0-54
hyperconverged-cluster-operator-container-v4.9.0-57
hyperconverged-cluster-webhook-container-v4.9.0-57
hco-bundle-registry-container-v4.9.0-249
Security Fix(es):
* gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index
validation (CVE-2021-3121)
* golang: net/http: panic in ReadRequest and ReadResponse when reading a
very large header (CVE-2021-31525)
* golang: net: lookup functions may return invalid host names
(CVE-2021-33195)
* golang: net/http/httputil: ReverseProxy forwards connection headers if
first one is empty (CVE-2021-33197)
* golang: math/big.Rat: may cause a panic or an unrecoverable fatal error
if passed inputs with very large exponents (CVE-2021-33198)
* golang: crypto/tls: certificate of wrong type is causing TLS client to
panic (CVE-2021-34558)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Topics Covered
References
https://access.redhat.com/security/cve/CVE-2020-25648 https://access.redhat.com/security/cve/CVE-2021-3121 https://access.redhat.com/security/cve/CVE-2021-3653 https://access.redhat.com/security/cve/CVE-2021-22922 https://access.redhat.com/security/cve/CVE-2021-22923 https://access.redhat.com/security/cve/CVE-2021-22924 https://access.redhat.com/security/cve/CVE-2021-31525 https://access.redhat.com/security/cve/CVE-2021-33195 https://access.redhat.com/security/cve/CVE-2021-33197 https://access.redhat.com/security/cve/CVE-2021-33198 https://access.redhat.com/security/cve/CVE-2021-34558 https://access.redhat.com/security/cve/CVE-2021-36222 https://access.redhat.com/security/cve/CVE-2021-37750 https://access.redhat.com/security/updates/classification#moderate
Package List
PREVIOUS
NEXT
Advisory ID: RHSA-2021:4104-01
Product: cnv
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4104
Issue date: 2021-11-02
Topic
Red Hat OpenShift Virtualization release 4.9.0 is now available withupdates to packages and images that fix several bugs and add enhancements.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topics Covered
Relevant Releases Architectures
Bugs Fixed
1858777 - Alert for VM with 'evictionStrategy: LiveMigrate' for local PVs set
1891921 - virt-launcher is missing /usr/share/zoneinfo directory, making it impossible to set clock offset of timezone type for the guest RTC
1896469 - In cluster with OVN Kubernetes networking - a node doesn't recover when configuring linux-bridge over its default NIC
1903687 - [scale] 1K DV creation failed
1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation
1933043 - Delete VM just after it turns into "running" is very likely to hit grace period end
1935219 - [CNV-2.5] Set memory and CPU request on hco-operator and hco-webhook deployments
1942726 - test automatic bug creation for a new release
1943164 - Node drain: Sometimes source virt-launcher pod status is Failed and not Completed
1945589 - Live migration with virtiofs is possible
1953481 - New OCP priority classes are not used - Deploy
1953483 - New OCP priority classes are not used - SSP
1953484 - New OCP priority classes are not used - Storage
1955129 - Failed to bindmount hotplug-disk for hostpath-provisioner
1957852 - Could not start VM as restore snapshot was still not Complete
1958341 - CVE-2021-31525 golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header
1963963 - hco.kubevirt.io:config-reader role and rolebinding are not strictly reconciled
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!