RedHat: RHSA-2022-5004:01 Critical: Red Hat OpenShift Service Mesh ...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: Red Hat OpenShift Service Mesh 2.1.3 security update
Advisory ID:       RHSA-2022:5004-01
Product:           Red Hat OpenShift Service Mesh
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:5004
Issue date:        2022-06-13
CVE Names:         CVE-2022-23772 CVE-2022-23773 CVE-2022-23806 
                   CVE-2022-29224 CVE-2022-29225 CVE-2022-29226 
                   CVE-2022-29228 CVE-2022-31045 
=====================================================================

1. Summary:

Red Hat OpenShift Service Mesh 2.1.3 has been released.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

OpenShift Service Mesh 2.1 - noarch, ppc64le, s390x, x86_64

3. Description:

Red Hat OpenShift Service Mesh is a Red Hat distribution of the Istio
service mesh project, tailored for installation into an on-premise
OpenShift Container Platform installation.

This advisory covers the RPM packages for the release.

Security Fix(es):

* envoy: oauth filter allows trivial bypass (CVE-2022-29226)
* envoy: Decompressors can be zip bombed (CVE-2022-29225)
* envoy: oauth filter calls continueDecoding() from within decodeHeaders()
(CVE-2022-29228)
* golang: math/big: uncontrolled memory consumption due to an unhandled
overflow via Rat.SetString (CVE-2022-23772)
* golang: cmd/go: misinterpretation of branch names can lead to incorrect
access control (CVE-2022-23773)
* golang: crypto/elliptic IsOnCurve returns true for invalid field elements
(CVE-2022-23806)
* envoy: Segfault in GrpcHealthCheckerImpl (CVE-2022-29224)
* Istio: Unsafe memory access in metadata exchange (CVE-2022-31045)

For more details about the security issues, including the impact, a CVSS
score, acknowledgments, and other related information, see the CVE page
listed in the References section.

4. Solution:

The OpenShift Service Mesh Release Notes provide information on the
features and known issues. See the link in the References section.

5. Bugs fixed (https://bugzilla.redhat.com/):

2053429 - CVE-2022-23806 golang: crypto/elliptic IsOnCurve returns true for invalid field elements
2053532 - CVE-2022-23772 golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString
2053541 - CVE-2022-23773 golang: cmd/go: misinterpretation of branch names can lead to incorrect access control
2088737 - CVE-2022-29225 envoy: Decompressors can be zip bombed
2088738 - CVE-2022-29224 envoy: Segfault in GrpcHealthCheckerImpl
2088739 - CVE-2022-29226 envoy: oauth filter allows trivial bypass
2088740 - CVE-2022-29228 envoy: oauth filter calls continueDecoding() from within decodeHeaders()
2088819 - CVE-2022-31045 Istio: Unsafe memory access in metadata exchange.

6. JIRA issues fixed (https://issues.jboss.org/):

OSSM-1107 - Take jwksResolverExtraRootCA out of TechPreview 
OSSM-1614 - RPM Release for Maistra 2.1.3

7. Package List:

OpenShift Service Mesh 2.1:

Source:
servicemesh-2.1.3-1.el8.src.rpm
servicemesh-operator-2.1.3-2.el8.src.rpm
servicemesh-prometheus-2.23.0-7.el8.src.rpm
servicemesh-proxy-2.1.3-1.el8.src.rpm
servicemesh-ratelimit-2.1.3-1.el8.src.rpm

noarch:
servicemesh-proxy-wasm-2.1.3-1.el8.noarch.rpm

ppc64le:
servicemesh-2.1.3-1.el8.ppc64le.rpm
servicemesh-cni-2.1.3-1.el8.ppc64le.rpm
servicemesh-operator-2.1.3-2.el8.ppc64le.rpm
servicemesh-pilot-agent-2.1.3-1.el8.ppc64le.rpm
servicemesh-pilot-discovery-2.1.3-1.el8.ppc64le.rpm
servicemesh-prometheus-2.23.0-7.el8.ppc64le.rpm
servicemesh-proxy-2.1.3-1.el8.ppc64le.rpm
servicemesh-proxy-debuginfo-2.1.3-1.el8.ppc64le.rpm
servicemesh-proxy-debugsource-2.1.3-1.el8.ppc64le.rpm
servicemesh-ratelimit-2.1.3-1.el8.ppc64le.rpm

s390x:
servicemesh-2.1.3-1.el8.s390x.rpm
servicemesh-cni-2.1.3-1.el8.s390x.rpm
servicemesh-operator-2.1.3-2.el8.s390x.rpm
servicemesh-pilot-agent-2.1.3-1.el8.s390x.rpm
servicemesh-pilot-discovery-2.1.3-1.el8.s390x.rpm
servicemesh-prometheus-2.23.0-7.el8.s390x.rpm
servicemesh-proxy-2.1.3-1.el8.s390x.rpm
servicemesh-proxy-debuginfo-2.1.3-1.el8.s390x.rpm
servicemesh-proxy-debugsource-2.1.3-1.el8.s390x.rpm
servicemesh-ratelimit-2.1.3-1.el8.s390x.rpm

x86_64:
servicemesh-2.1.3-1.el8.x86_64.rpm
servicemesh-cni-2.1.3-1.el8.x86_64.rpm
servicemesh-operator-2.1.3-2.el8.x86_64.rpm
servicemesh-pilot-agent-2.1.3-1.el8.x86_64.rpm
servicemesh-pilot-discovery-2.1.3-1.el8.x86_64.rpm
servicemesh-prometheus-2.23.0-7.el8.x86_64.rpm
servicemesh-proxy-2.1.3-1.el8.x86_64.rpm
servicemesh-proxy-debuginfo-2.1.3-1.el8.x86_64.rpm
servicemesh-proxy-debugsource-2.1.3-1.el8.x86_64.rpm
servicemesh-ratelimit-2.1.3-1.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

8. References:

https://access.redhat.com/security/cve/CVE-2022-23772
https://access.redhat.com/security/cve/CVE-2022-23773
https://access.redhat.com/security/cve/CVE-2022-23806
https://access.redhat.com/security/cve/CVE-2022-29224
https://access.redhat.com/security/cve/CVE-2022-29225
https://access.redhat.com/security/cve/CVE-2022-29226
https://access.redhat.com/security/cve/CVE-2022-29228
https://access.redhat.com/security/cve/CVE-2022-31045
https://access.redhat.com/security/updates/classification/#critical
https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html

9. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYuFj49zjgjWX9erEAQgckw//dWuW9UCVvebhaNN2VyMupXOGEXMXlBp2
RUbS4wp6/7x9c8UOvcBWhZORVzZ+MNRYp2137Otb0YB17LTs8VAzsLiU5bTvc//y
CE4Cwfqg/RPoNOFZHnjHDRoldK42L0Wqon/+e6fYbjRL8ECbwnMOLl3qKbhuigi1
tLm5naN3Y7U4F+R6Fgi7iniL9cYmAd+Y3BlDij8Wf6PJSHUfSh6PaduYgnXavS7p
u6Vzg3QKqFDKyU2nXKNSB9VsJ7mMs0Nza6tfpAwhoIO36D54NqgTCBMgxKdnohhM
ZIBVqFVAxABDKlsMoMG2dfJR7c+aHTGC4PC53b/KTU+f+F9uBbk5OpXEjCODe+K3
4mmq3CoeTKE+HGhb3hCbO+X3jhG2wWK8fRcgsYagbszH5zHqnfM5YDVYvH/EMlun
gXcS/sFoATqwf2nxenPYzQrkJKwUBL+74jWLshK44PvlR0n1EWUPGrHeMymGWWz8
8BB9e6GVEqPRqW2AQKkuEqardLZRHuERkP9g6GSfxi7pXU5phDWF+c3tC5klGhew
ffIvOsvBmcpov+5W+p4vHTNW/3gATrCDFvT9fJBOMGLNk6LzTHqoxqB5Ev+qgRBo
UcZRaTlTTwiBf5NcYTBPLvoqjilahFpA1kKkN/YTCHePtHy7bY1L8MveVsV6MW0d
a36YRXXR0Dc=
=demi
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-5004:01 Critical: Red Hat OpenShift Service Mesh 2.1.3

Red Hat OpenShift Service Mesh 2.1.3 has been released

Summary

Red Hat OpenShift Service Mesh is a Red Hat distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
This advisory covers the RPM packages for the release.
Security Fix(es):
* envoy: oauth filter allows trivial bypass (CVE-2022-29226) * envoy: Decompressors can be zip bombed (CVE-2022-29225) * envoy: oauth filter calls continueDecoding() from within decodeHeaders() (CVE-2022-29228) * golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772) * golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773) * golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806) * envoy: Segfault in GrpcHealthCheckerImpl (CVE-2022-29224) * Istio: Unsafe memory access in metadata exchange (CVE-2022-31045)
For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, see the CVE page listed in the References section.

Solution

The OpenShift Service Mesh Release Notes provide information on thefeatures and known issues. See the link in the References section.

References

https://access.redhat.com/security/cve/CVE-2022-23772 https://access.redhat.com/security/cve/CVE-2022-23773 https://access.redhat.com/security/cve/CVE-2022-23806 https://access.redhat.com/security/cve/CVE-2022-29224 https://access.redhat.com/security/cve/CVE-2022-29225 https://access.redhat.com/security/cve/CVE-2022-29226 https://access.redhat.com/security/cve/CVE-2022-29228 https://access.redhat.com/security/cve/CVE-2022-31045 https://access.redhat.com/security/updates/classification/#critical https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html

Package List

OpenShift Service Mesh 2.1:
Source: servicemesh-2.1.3-1.el8.src.rpm servicemesh-operator-2.1.3-2.el8.src.rpm servicemesh-prometheus-2.23.0-7.el8.src.rpm servicemesh-proxy-2.1.3-1.el8.src.rpm servicemesh-ratelimit-2.1.3-1.el8.src.rpm
noarch: servicemesh-proxy-wasm-2.1.3-1.el8.noarch.rpm
ppc64le: servicemesh-2.1.3-1.el8.ppc64le.rpm servicemesh-cni-2.1.3-1.el8.ppc64le.rpm servicemesh-operator-2.1.3-2.el8.ppc64le.rpm servicemesh-pilot-agent-2.1.3-1.el8.ppc64le.rpm servicemesh-pilot-discovery-2.1.3-1.el8.ppc64le.rpm servicemesh-prometheus-2.23.0-7.el8.ppc64le.rpm servicemesh-proxy-2.1.3-1.el8.ppc64le.rpm servicemesh-proxy-debuginfo-2.1.3-1.el8.ppc64le.rpm servicemesh-proxy-debugsource-2.1.3-1.el8.ppc64le.rpm servicemesh-ratelimit-2.1.3-1.el8.ppc64le.rpm
s390x: servicemesh-2.1.3-1.el8.s390x.rpm servicemesh-cni-2.1.3-1.el8.s390x.rpm servicemesh-operator-2.1.3-2.el8.s390x.rpm servicemesh-pilot-agent-2.1.3-1.el8.s390x.rpm servicemesh-pilot-discovery-2.1.3-1.el8.s390x.rpm servicemesh-prometheus-2.23.0-7.el8.s390x.rpm servicemesh-proxy-2.1.3-1.el8.s390x.rpm servicemesh-proxy-debuginfo-2.1.3-1.el8.s390x.rpm servicemesh-proxy-debugsource-2.1.3-1.el8.s390x.rpm servicemesh-ratelimit-2.1.3-1.el8.s390x.rpm
x86_64: servicemesh-2.1.3-1.el8.x86_64.rpm servicemesh-cni-2.1.3-1.el8.x86_64.rpm servicemesh-operator-2.1.3-2.el8.x86_64.rpm servicemesh-pilot-agent-2.1.3-1.el8.x86_64.rpm servicemesh-pilot-discovery-2.1.3-1.el8.x86_64.rpm servicemesh-prometheus-2.23.0-7.el8.x86_64.rpm servicemesh-proxy-2.1.3-1.el8.x86_64.rpm servicemesh-proxy-debuginfo-2.1.3-1.el8.x86_64.rpm servicemesh-proxy-debugsource-2.1.3-1.el8.x86_64.rpm servicemesh-ratelimit-2.1.3-1.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2022:5004-01
Product: Red Hat OpenShift Service Mesh
Advisory URL: https://access.redhat.com/errata/RHSA-2022:5004
Issued Date: : 2022-06-13
CVE Names: CVE-2022-23772 CVE-2022-23773 CVE-2022-23806 CVE-2022-29224 CVE-2022-29225 CVE-2022-29226 CVE-2022-29228 CVE-2022-31045

Topic

Red Hat OpenShift Service Mesh 2.1.3 has been released.Red Hat Product Security has rated this update as having a security impactof Critical. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

OpenShift Service Mesh 2.1 - noarch, ppc64le, s390x, x86_64

Bugs Fixed

2053429 - CVE-2022-23806 golang: crypto/elliptic IsOnCurve returns true for invalid field elements

2053532 - CVE-2022-23772 golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString

2053541 - CVE-2022-23773 golang: cmd/go: misinterpretation of branch names can lead to incorrect access control

2088737 - CVE-2022-29225 envoy: Decompressors can be zip bombed

2088738 - CVE-2022-29224 envoy: Segfault in GrpcHealthCheckerImpl

2088739 - CVE-2022-29226 envoy: oauth filter allows trivial bypass

2088740 - CVE-2022-29228 envoy: oauth filter calls continueDecoding() from within decodeHeaders()

2088819 - CVE-2022-31045 Istio: Unsafe memory access in metadata exchange.

6. JIRA issues fixed (https://issues.jboss.org/):

OSSM-1107 - Take jwksResolverExtraRootCA out of TechPreview

OSSM-1614 - RPM Release for Maistra 2.1.3

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.