Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Red Hat 3scale API Management 2.11.1 Security Advisory: Moderate Risks

red hat
Calendar Grey December 16, 2021
Dist Redhat Esm H88
A critical patch for Red Hat 3scale API Management version 2.11.1 has been released to address significant vulnerabilities found within container images.
Red Hat 3scale API Management 2.11.1 Release - Container Images A security update for Red Hat 3scale API Management is now available from the Red Hat Container Catalog

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_3scale_api_management/2.11/html-single/installing_3scale/index

Summary

Red Hat 3scale API Management delivers centralized API management features through a distributed, cloud-hosted layer. It includes built-in features to help in building a more successful API program, including access control, rate limits, payment gateway integration, and developer experience tools.
This advisory is intended to use with Container Images, for Red Hat 3scale API Management 2.11.1.
Security Fix(es):
* rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema (CVE-2020-26247)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory moderate security impact container images red hat 3scale api management

References

https://access.redhat.com/security/cve/CVE-2020-26247 https://access.redhat.com/security/cve/CVE-2020-36385 https://access.redhat.com/security/cve/CVE-2021-0512 https://access.redhat.com/security/cve/CVE-2021-3656 https://access.redhat.com/security/cve/CVE-2021-3733 https://access.redhat.com/security/cve/CVE-2021-22946 https://access.redhat.com/security/cve/CVE-2021-22947 https://access.redhat.com/security/cve/CVE-2021-33928 https://access.redhat.com/security/cve/CVE-2021-33929 https://access.redhat.com/security/cve/CVE-2021-33930 https://access.redhat.com/security/cve/CVE-2021-33938 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_3scale_api_management/2.11/html-single/installing_3scale/index

Package List


Advisory ID: RHSA-2021:5191-01
Product: 3scale API Management
Advisory URL: https://access.redhat.com/errata/RHSA-2021:5191
Issue date: 2021-12-16

Topic

Red Hat 3scale API Management 2.11.1 Release - Container ImagesA security update for Red Hat 3scale API Management is now available fromthe Red Hat Container Catalog.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerabilitylisted as CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate security impact container images red hat 3scale api management

Relevant Releases Architectures

Bugs Fixed

1912487 - CVE-2020-26247 rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema

5. JIRA issues fixed (https://issues.redhat.com/):

THREESCALE-6868 - [3scale][2.11][LO-prio] Improve select default Application plan

THREESCALE-6879 - [3scale][2.11][HI-prio] Add 'Create new Application' flow to Product > Applications index

THREESCALE-7030 - Address scalability in 'Create new Application' form

THREESCALE-7203 - Fix Zync resync command in 5.6.9. Creating equivalent Zync routes

THREESCALE-7475 - Some api calls result in "Destroying user session"

THREESCALE-7488 - Ability to add external Lua dependencies for custom policies

THREESCALE-7573 - Enable proxy environment variables via the APICAST CRD

THREESCALE-7605 - type change of "policies_config" in /admin/api/services/{service_id}/proxy.json

THREESCALE-7633 - Signup form in developer portal is disabled for users authenticted via external SSO

THREESCALE-7644 - Metrics: Service for 3scale operator is missing

THREESCALE-7646 - Cleanup/refactor Products and Backends index logic

THREESCALE-7648 - Remove "#context-menu" from the url

THREESCALE-7704 - Images based on RHEL 7 should contain at least ca-certificates-2021.2.50-72.el7_9.noarch.rpm

THREESCALE-7731 - Reenable operator metrics service for apicast-operator

THREESCALE-7761 - 3scale Operator doesn't respect *_proxy env varsTHREESCALE-7765 - Remove MessageBus from System

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here