RedHat: RHSA-2022-1739:01 Moderate: Red Hat OpenShift Service Mesh ...

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenShift Service Mesh 2.1.2.1 containers security update
Advisory ID:       RHSA-2022:1739-01
Product:           Red Hat OpenShift Service Mesh
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:1739
Issue date:        2022-05-05
CVE Names:         CVE-2021-44906 CVE-2022-0235 CVE-2022-0536 
                   CVE-2022-0778 CVE-2022-24771 CVE-2022-24772 
                   CVE-2022-24773 CVE-2022-25235 CVE-2022-25236 
                   CVE-2022-25315 
=====================================================================

1. Summary:

An update for is now available for OpenShift Service Mesh 2.1.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio
service mesh project, tailored for installation into an on-premise
OpenShift Container Platform installation.

This advisory covers the containers for the release.

Security Fix(es):

* minimist: prototype pollution (CVE-2021-44906)
* node-fetch: exposure of sensitive information to an unauthorized actor
(CVE-2022-0235)
* follow-redirects: Exposure of Sensitive Information via Authorization
Header leak (CVE-2022-0536)
* node-forge: Signature verification leniency in checking `digestAlgorithm`
structure can lead to signature forgery (CVE-2022-24771)
* node-forge: Signature verification failing to check tailing garbage bytes
can lead to signature forgery (CVE-2022-24772)
* node-forge: Signature verification leniency in checking `DigestInfo`
structure (CVE-2022-24773)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The OpenShift Service Mesh Release Notes provide information on the
features and known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html

4. Bugs fixed (https://bugzilla.redhat.com/):

2044591 - CVE-2022-0235 node-fetch: exposure of sensitive information to an unauthorized actor
2053259 - CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak
2066009 - CVE-2021-44906 minimist: prototype pollution
2067387 - CVE-2022-24771 node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery
2067458 - CVE-2022-24772 node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery
2067461 - CVE-2022-24773 node-forge: Signature verification leniency in checking `DigestInfo` structure

5. JIRA issues fixed (https://issues.jboss.org/):

OSSM-1435 - Container release for Maistra 2.1.2.1

6. References:

https://access.redhat.com/security/cve/CVE-2021-44906
https://access.redhat.com/security/cve/CVE-2022-0235
https://access.redhat.com/security/cve/CVE-2022-0536
https://access.redhat.com/security/cve/CVE-2022-0778
https://access.redhat.com/security/cve/CVE-2022-24771
https://access.redhat.com/security/cve/CVE-2022-24772
https://access.redhat.com/security/cve/CVE-2022-24773
https://access.redhat.com/security/cve/CVE-2022-25235
https://access.redhat.com/security/cve/CVE-2022-25236
https://access.redhat.com/security/cve/CVE-2022-25315
https://access.redhat.com/security/updates/classification/#moderate

7. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYnRM3tzjgjWX9erEAQjZ+g//daw+NHFztb9cgW1y0S30efFHVrQ2iDOv
ic1hZeEFPTYXKsKFaRV5h61OmcuKt76eRmV6zzHqZFl0Fqh/Q1gMOFn4baTEMwbZ
7Mld2aTezzFis3FMNPIm3ioZCpEuFafrp18zqtzpr4YtXkVyLdSSchYSAV7XuHJV
BkGYWJmZ8Y62hLctiXsDdKaKJdvHvZCYY38zOpeupFCId8vvOqPX6HH6iixg9+Qz
zGcuYqmkXHjXjFO/Tpy0xxD2cQUDUt587yBgSV9i8uNyNqxAscWVMU5swXz316+V
mnaFwjBbdVggpCTo7/AlPREnYDHbjtK0N4IEYg+wJ71pX/RPYJgxFdtn+zmtiUfO
xTOWkLi/jdtNtqgZ1mMVAFyq+v/eJ6yrRmGhQ6OTSJATnq1+Orjj+cN9TWgKx8hD
OPrG68mK8VgyAv1QjjGMJz8EnTr/XrFcXkVLDHzfDXOR6JIa8bL/dBC+lAcjIwUo
SEHyvr4etRMYOP+QQOEsN0Bs+8ZiE9NngsgzAicwt4iXZqq0vRfvOzj60bscLaQp
koG4SSfftSwKPZZz/kasaEIYOrWgsJOqbo5tjzICsZaMjdeNTbIxyBAK1okEVHfO
omZxnp3SoMcu1VZcImXtWf7QqplFhrJZmMH3zxfI4I7ChEURH3HGi3h0ZtcwyXux
ViFqVVqTRV4=
=EzG0
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-1739:01 Moderate: Red Hat OpenShift Service Mesh 2.1.2.1

An update for is now available for OpenShift Service Mesh 2.1

Summary

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
This advisory covers the containers for the release.
Security Fix(es):
* minimist: prototype pollution (CVE-2021-44906) * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235) * follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536) * node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery (CVE-2022-24771) * node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery (CVE-2022-24772) * node-forge: Signature verification leniency in checking `DigestInfo` structure (CVE-2022-24773)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258The OpenShift Service Mesh Release Notes provide information on thefeatures and known issues:https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html

References

https://access.redhat.com/security/cve/CVE-2021-44906 https://access.redhat.com/security/cve/CVE-2022-0235 https://access.redhat.com/security/cve/CVE-2022-0536 https://access.redhat.com/security/cve/CVE-2022-0778 https://access.redhat.com/security/cve/CVE-2022-24771 https://access.redhat.com/security/cve/CVE-2022-24772 https://access.redhat.com/security/cve/CVE-2022-24773 https://access.redhat.com/security/cve/CVE-2022-25235 https://access.redhat.com/security/cve/CVE-2022-25236 https://access.redhat.com/security/cve/CVE-2022-25315 https://access.redhat.com/security/updates/classification/#moderate

Package List

Severity
Advisory ID: RHSA-2022:1739-01
Product: Red Hat OpenShift Service Mesh
Advisory URL: https://access.redhat.com/errata/RHSA-2022:1739
Issued Date: : 2022-05-05
CVE Names: CVE-2021-44906 CVE-2022-0235 CVE-2022-0536 CVE-2022-0778 CVE-2022-24771 CVE-2022-24772 CVE-2022-24773 CVE-2022-25235 CVE-2022-25236 CVE-2022-25315

Topic

An update for is now available for OpenShift Service Mesh 2.1.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Bugs Fixed

2044591 - CVE-2022-0235 node-fetch: exposure of sensitive information to an unauthorized actor

2053259 - CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak

2066009 - CVE-2021-44906 minimist: prototype pollution

2067387 - CVE-2022-24771 node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery

2067458 - CVE-2022-24772 node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery

2067461 - CVE-2022-24773 node-forge: Signature verification leniency in checking `DigestInfo` structure

5. JIRA issues fixed (https://issues.jboss.org/):

OSSM-1435 - Container release for Maistra 2.1.2.1

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.