Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Security Update for Red Hat OpenShift Serverless 1.20.0 RHSA-2022:0434-01

red hat
Calendar Grey February 3, 2022
Dist Redhat Esm H88
The balanced update for OpenShift Serverless 1.20.0 features essential corrections addressing multiple security vulnerabilities within Red Hat.
Release of OpenShift Serverless 1.20.0 Red Hat Product Security has rated this update as having a security impact of Moderate

Solution

See the Red Hat OpenShift Container Platform 4.6 documentation at: https://docs.redhat.com/en/documentation/red_hat_openshift_serverless/1.33 See the Red Hat OpenShift Container Platform 4.7 documentation at: https://docs.redhat.com/en/documentation/red_hat_openshift_serverless/1.33 See the Red Hat OpenShift Container Platform 4.8 documentation at: https://docs.redhat.com/en/documentation/red_hat_openshift_serverless/1.33 See the Red Hat OpenShift Container Platform 4.9 documentation at: https://docs.redhat.com/en/documentation/red_hat_openshift_serverless/1.33

Summary

This version of the OpenShift Serverless Operator is supported on Red Hat OpenShift Container Platform versions 4.6, 4.7, 4.8, and 4.9, and includes security and bug fixes and enhancements. For more information, see the documentation listed in the References section.
Security Fix(es):
* golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet (CVE-2021-29923)
* golang: Command-line arguments may overwrite global data (CVE-2021-38297)
* golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory moderate Red Hat security fix CVE issues OpenShift Red Hat OpenShift Serverless

References

https://access.redhat.com/security/cve/CVE-2019-5827 https://access.redhat.com/security/cve/CVE-2019-13750 https://access.redhat.com/security/cve/CVE-2019-13751 https://access.redhat.com/security/cve/CVE-2019-17594 https://access.redhat.com/security/cve/CVE-2019-17595 https://access.redhat.com/security/cve/CVE-2019-18218 https://access.redhat.com/security/cve/CVE-2019-19603 https://access.redhat.com/security/cve/CVE-2019-20838 https://access.redhat.com/security/cve/CVE-2020-12762 https://access.redhat.com/security/cve/CVE-2020-13435 https://access.redhat.com/security/cve/CVE-2020-14155 https://access.redhat.com/security/cve/CVE-2020-16135 https://access.redhat.com/security/cve/CVE-2020-24370 https://access.redhat.com/security/cve/CVE-2021-3200 https://access.redhat.com/security/cve/CVE-2021-3445 https://access.redhat.com/security/cve/CVE-2021-3580 https://access.redhat.com/security/cve/CVE-2021-3712 https://access.redhat.com/security/cve/CVE-2021-3800 https://access.redhat.com/security/cve/CVE-2021-20231 https://access.redhat.com/security/cve/CVE-2021-20232 https://access.redhat.com/security/cve/CVE-2021-20266 https://access.redhat.com/security/cve/CVE-2021-22876 https://access.redhat.com/security/cve/CVE-2021-22898 Read the Full Advisory

Package List


Advisory ID: RHSA-2022:0434-01
Product: Red Hat OpenShift Serverless
Advisory URL: https://access.redhat.com/errata/RHSA-2022:0434
Issue date: 2022-02-03

Topic

Release of OpenShift Serverless 1.20.0Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate Red Hat security fix CVE issues OpenShift Red Hat OpenShift Serverless

Relevant Releases Architectures

Bugs Fixed

1992006 - CVE-2021-29923 golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

2006044 - CVE-2021-39293 golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)

2012887 - CVE-2021-38297 golang: Command-line arguments may overwrite global data

2024838 - Release of OpenShift Serverless Eventing 1.20.0

2024839 - Release of OpenShift Serverless Serving 1.20.0

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here