RedHat: RHSA-2022-4956-01 Important: ACM 2.5 Security Updates Critical

Red Hat Advanced Cluster Management for Kubernetes 2.5.0 images
Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs and security issues. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.5/html/release_notes/index
Security fixes:
* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)
* containerd: Unprivileged pod may bind mount any privileged regular file on disk (CVE-2021-43816)
* minio: user privilege escalation in AddUser() admin API (CVE-2021-43858)
* openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)
* imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path (CVE-2022-24778)
* golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565)
* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
* nconf: Prototype pollution in memory store (CVE-2022-21803)
* golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)
* nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account (CVE-2022-24450)
* Moment.js: Path traversal in moment.locale (CVE-2022-24785)
* golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
* go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses (CVE-2022-29810)
* opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)
Bug fixes:
* RFE Copy secret with specific secret namespace, name for source and name, namespace and cluster label for target (BZ# 2014557)
* RHACM 2.5.0 images (BZ# 2024938)
* [UI] When you delete host agent from infraenv no confirmation message appear (Are you sure you want to delete x?) (BZ#2028348)
* Clusters are in 'Degraded' status with upgrade env due to obs-controller not working properly (BZ# 2028647)
* create cluster pool -> choose infra type, As a result infra providersdisappear from UI. (BZ# 2033339)
* Restore/backup shows up as Validation failed but the restore backup status in ACM shows success (BZ# 2034279)
* Observability - OCP 311 node role are not displayed completely (BZ# 2038650)
* Documented uninstall procedure leaves many leftovers (BZ# 2041921)
* infrastructure-operator pod crashes due to insufficient privileges in ACM 2.5 (BZ# 2046554)
* Acm failed to install due to some missing CRDs in operator (BZ# 2047463)
* Navigation icons no longer showing in ACM 2.5 (BZ# 2051298)
* ACM home page now includes /home/ in url (BZ# 2051299)
* proxy heading in Add Credential should be capitalized (BZ# 2051349)
* ACM 2.5 tries to create new MCE instance when install on top of existing MCE 2.0 (BZ# 2051983)
* Create Policy button does not work and user cannot use console to create policy (BZ# 2053264)
* No cluster information was displayed after a policyset was created (BZ# 2053366)
* Dynamic plugin update does not take effect in Firefox (BZ# 2053516)
* Replicated policy should not be available when creating a Policy Set (BZ# 2054431)
* Placement section in Policy Set wizard does not reset when users click "Back" to re-configured placement (BZ# 2054433)