Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Red Hat OpenShift 4.10.1 RHSA-2022-4668 Moderate Impact Image Updates

red hat
Calendar Grey May 18, 2022
Dist Redhat Esm H88
Red Hat OpenShift Virtualization 4.10.1 Images have been made available, addressing several bugs and enhancements that present a moderate security concern.
Red Hat OpenShift Virtualization release 4.10.1 is now available with updates to packages and images that fix several bugs and add enhancements

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.
This advisory contains the following OpenShift Virtualization 4.10.1 images:
RHEL-8-CNV-4.10 ============= virtio-win-container-v4.10.1-4 hostpath-provisioner-operator-container-v4.10.1-6 bridge-marker-container-v4.10.1-12 cnv-containernetworking-plugins-container-v4.10.1-12 ovs-cni-plugin-container-v4.10.1-12 kubemacpool-container-v4.10.1-12 ovs-cni-marker-container-v4.10.1-12 kubernetes-nmstate-handler-container-v4.10.1-12 cluster-network-addons-operator-container-v4.10.1-12 cnv-must-gather-container-v4.10.1-15 hyperconverged-cluster-webhook-container-v4.10.1-19 hyperconverged-cluster-operator-container-v4.10.1-19 kubevirt-ssp-operator-container-v4.10.1-10 virt-cdi-apiserver-container-v4.10.1-16 virt-cdi-controller-container-v4.10.1-16 hostpath-provisioner-container-v4.10.1-5 virt-cdi-uploadserver-container-v4.10.1-16 node-maintenance-operator-container-v4.10.1-4 virt-cdi-operator-container-v4.10.1-16 virt-cdi-uploadproxy-container-v4.10.1-16 hostpath-csi-driver-container-v4.10.1-5 virt-cdi-cloner-container-v4.10.1-16 kubevirt-template-validator-container-v4.10.1-4 virt-cdi-importer-container-v4.10.1-16 virt-api-container-v4.10.1-8 virt-handler-container-v4.10.1-8 virt-controller-container-v4.10.1-8 virt-launcher-container-v4.10.1-8 virt-artifacts-server-container-v4.10.1-8 libguestfs-tools-container-v4.10.1-8 virt-operator-container-v4.10.1-8 hco-bundle-registry-container-v4.10.1-99
Security Fix(es):
* golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)
* prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
* opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat bug fix moderate impact OpenShift container security image update

References

https://access.redhat.com/security/cve/CVE-2021-36221 https://access.redhat.com/security/cve/CVE-2021-41190 https://access.redhat.com/security/cve/CVE-2022-0778 https://access.redhat.com/security/cve/CVE-2022-21698 https://access.redhat.com/security/cve/CVE-2022-24407 https://access.redhat.com/security/cve/CVE-2022-25235 https://access.redhat.com/security/cve/CVE-2022-25236 https://access.redhat.com/security/cve/CVE-2022-25315 https://access.redhat.com/security/updates/classification#moderate

Package List


Advisory ID: RHSA-2022:4668-01
Product: cnv
Advisory URL: https://access.redhat.com/errata/RHSA-2022:4668
Issue date: 2022-05-18

Topic

Red Hat OpenShift Virtualization release 4.10.1 is now available withupdates to packages and images that fix several bugs and add enhancements.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat bug fix moderate impact OpenShift container security image update

Relevant Releases Architectures

Bugs Fixed

1995656 - CVE-2021-36221 golang: net/http/httputil: panic due to racy read of persistConn after handler panic

2000478 - Using deprecated 1.25 API calls

2022742 - NNCP creation fails when node of a cluster is unavailable

2024938 - CVE-2021-41190 opencontainers: OCI manifest and index parsing confusion

2028619 - policy/v1beta1 PodDisruptionBudget is deprecated in v1.21+, unavailable in v1.25+

2029359 - NodeNetworkConfigurationPolicy refreshes all the conditions even if the policy has not gone to that state

2032837 - Add/remove label to priority class are not reconciled properly left HCO in Unknown status.

2033385 - Bug in kubernetes labels that are attached to the CNV logs

2038814 - [CNV-4.10-rhel9] hyperconverged-cluster-cli-download pod CrashLoopBackOff state

2039019 - Fix Top consumers dashboard

2045880 - CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter

2046686 - Importer pod keeps in retarting when dataimportcron has a reference to invalid image sha

2049990 - must-gather: must-gather is logging errors about upstream only namespaces

2053390 - No DataImportCron for CentOS 7

2054778 - PVC created with filesystem volume mode in some cases, instead of block volume mode

2054782 - DataImportCron status does not show failure when failing to create dataSource

2055304 - [4.10.z] nmstate interprets interface names as float64 and subsequently crashes on state update

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here