RedHat: RHSA-2022-6061:01 Important: Red Hat OpenStack Platform 16....
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat OpenStack Platform 16.2 (etcd) security update
Advisory ID:       RHSA-2022:6061-01
Product:           Red Hat OpenStack Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6061
Issue date:        2022-08-15
CVE Names:         CVE-2022-21698 CVE-2022-30631 
=====================================================================

1. Summary:

An update for etcd is now available for Red Hat OpenStack Platform 16.2
(Train).

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.2 - ppc64le, x86_64

3. Description:

The etcd packages provide a highly available key-value store for shared
configuration.

Security Fix(es):

* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

* prometheus/client_golang: Denial of service using
InstrumentHandlerCounter (CVE-2022-21698)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2045880 - CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter
2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read

6. Package List:

Red Hat OpenStack Platform 16.2:

Source:
etcd-3.3.23-10.el8ost.src.rpm

ppc64le:
etcd-3.3.23-10.el8ost.ppc64le.rpm
etcd-debuginfo-3.3.23-10.el8ost.ppc64le.rpm
etcd-debugsource-3.3.23-10.el8ost.ppc64le.rpm

x86_64:
etcd-3.3.23-10.el8ost.x86_64.rpm
etcd-debuginfo-3.3.23-10.el8ost.x86_64.rpm
etcd-debugsource-3.3.23-10.el8ost.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-21698
https://access.redhat.com/security/cve/CVE-2022-30631
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYvo20tzjgjWX9erEAQiX3w/7BqJylR0wjzoTZyhtzLAo5EtOYCcoBmzH
IhBuvxUmBgM8IvnqedPBGa17v5+7OsZvJKUqkZjfnIL9MFdrYSiaqHR1T4mS0Qsu
Q830AYyFU2sTSa22AmR03Xhfr4e3WXi+gYnR9dPqxuRvr2gaVMZ0R150kQSr+ez1
ZQ+58lv2krhnUZK1qznyxDRUSauRqRgQvjNjhVipA5q3mCDu0FuJkyEa+65MIyP7
4yTXRspx4Uk2fCIhm+RNRJPZTIG2t9vuX1tjozsoi3x6yiYGTMKh+OBGB2w8QIig
IOPZDlcbqh9/XZhpWo0sYLeBqHepOX3KE46q/40BhsjbOoKOdm7A4P81zxjNJ1lU
BbsKSEjeVQtEXAmLM1j0RNxAMYBfJJWS1Cu4mB3/M6kI2+gB6BzoPiPiZDt/5QU0
loujArrUdeEnWNy65JJ9fVhKNf7iJ5NAf8GHE9AEPmwQSXSIuf5g5z8N1zHGF/7x
O/uuHfx5XEBLkjMEpkSatxZ/RgMOvbKOQRMGuFMq621BOFsjsh7hyzeo3LJC5e1z
75j5cXzd0VVLsr19HrB7HoinAQZvFALf5Qw0Uqd1Abcr+wPaN32NPjb+WNMU987/
1bocpSrFlbcycLN7CH1AfVR6XdNSctdzAbGv2AwLcuqsro5e5QEEPZSI1/yMLc9B
KZvTwvCKViQ=
=d4+p
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-6061:01 Important: Red Hat OpenStack Platform 16.2 (etcd)

An update for etcd is now available for Red Hat OpenStack Platform 16.2 (Train)

Summary

The etcd packages provide a highly available key-value store for shared configuration.
Security Fix(es):
* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
* prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2022-21698 https://access.redhat.com/security/cve/CVE-2022-30631 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat OpenStack Platform 16.2:
Source: etcd-3.3.23-10.el8ost.src.rpm
ppc64le: etcd-3.3.23-10.el8ost.ppc64le.rpm etcd-debuginfo-3.3.23-10.el8ost.ppc64le.rpm etcd-debugsource-3.3.23-10.el8ost.ppc64le.rpm
x86_64: etcd-3.3.23-10.el8ost.x86_64.rpm etcd-debuginfo-3.3.23-10.el8ost.x86_64.rpm etcd-debugsource-3.3.23-10.el8ost.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2022:6061-01
Product: Red Hat OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2022:6061
Issued Date: : 2022-08-15
CVE Names: CVE-2022-21698 CVE-2022-30631

Topic

An update for etcd is now available for Red Hat OpenStack Platform 16.2(Train).Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat OpenStack Platform 16.2 - ppc64le, x86_64

Bugs Fixed

2045880 - CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter

2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.