RedHat: RHSA-2022-6277:01 Moderate: Red Hat OpenShift Service Mesh 2.1.5
Summary
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio
service mesh project, tailored for installation into an OpenShift Container
Platform installation.
This advisory covers the RPM packages for the release.
Security Fix(es):
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
* golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675)
* moment: Moment.js: Path traversal in moment.locale (CVE-2022-24785)
* golang: regexp: stack exhaustion via a deeply nested expression
(CVE-2022-24921)
* golang: crypto/elliptic: panic caused by oversized scalar
(CVE-2022-28327)
* golang: syscall: faccessat checks wrong group (CVE-2022-29526)
* golang: crypto/tls: session tickets lack random ticket_age_add
(CVE-2022-30629)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Summary
Solution
The OpenShift Service Mesh Release Notes provide information on the
features and known issues:
https://docs.openshift.com/container-platform/4.14/service_mesh/v2x/servicemesh-release-notes.html
References
https://access.redhat.com/security/cve/CVE-2022-24675 https://access.redhat.com/security/cve/CVE-2022-24785 https://access.redhat.com/security/cve/CVE-2022-24921 https://access.redhat.com/security/cve/CVE-2022-28327 https://access.redhat.com/security/cve/CVE-2022-29526 https://access.redhat.com/security/cve/CVE-2022-30629 https://access.redhat.com/security/cve/CVE-2022-31129 https://access.redhat.com/security/updates/classification/#moderate
Package List
OpenShift Service Mesh 2.1:
Source:
servicemesh-2.1.5-1.el8.src.rpm
servicemesh-operator-2.1.5-1.el8.src.rpm
servicemesh-prometheus-2.23.0-9.el8.src.rpm
servicemesh-proxy-2.1.5-1.el8.src.rpm
servicemesh-ratelimit-2.1.5-1.el8.src.rpm
noarch:
servicemesh-proxy-wasm-2.1.5-1.el8.noarch.rpm
ppc64le:
servicemesh-2.1.5-1.el8.ppc64le.rpm
servicemesh-cni-2.1.5-1.el8.ppc64le.rpm
servicemesh-operator-2.1.5-1.el8.ppc64le.rpm
servicemesh-pilot-agent-2.1.5-1.el8.ppc64le.rpm
servicemesh-pilot-discovery-2.1.5-1.el8.ppc64le.rpm
servicemesh-prometheus-2.23.0-9.el8.ppc64le.rpm
servicemesh-proxy-2.1.5-1.el8.ppc64le.rpm
servicemesh-proxy-debuginfo-2.1.5-1.el8.ppc64le.rpm
servicemesh-proxy-debugsource-2.1.5-1.el8.ppc64le.rpm
servicemesh-ratelimit-2.1.5-1.el8.ppc64le.rpm
s390x:
servicemesh-2.1.5-1.el8.s390x.rpm
servicemesh-cni-2.1.5-1.el8.s390x.rpm
servicemesh-operator-2.1.5-1.el8.s390x.rpm
servicemesh-pilot-agent-2.1.5-1.el8.s390x.rpm
servicemesh-pilot-discovery-2.1.5-1.el8.s390x.rpm
servicemesh-prometheus-2.23.0-9.el8.s390x.rpm
servicemesh-proxy-2.1.5-1.el8.s390x.rpm
servicemesh-proxy-debuginfo-2.1.5-1.el8.s390x.rpm
servicemesh-proxy-debugsource-2.1.5-1.el8.s390x.rpm
servicemesh-ratelimit-2.1.5-1.el8.s390x.rpm
x86_64:
servicemesh-2.1.5-1.el8.x86_64.rpm
servicemesh-cni-2.1.5-1.el8.x86_64.rpm
servicemesh-operator-2.1.5-1.el8.x86_64.rpm
servicemesh-pilot-agent-2.1.5-1.el8.x86_64.rpm
servicemesh-pilot-discovery-2.1.5-1.el8.x86_64.rpm
servicemesh-prometheus-2.23.0-9.el8.x86_64.rpm
servicemesh-proxy-2.1.5-1.el8.x86_64.rpm
servicemesh-proxy-debuginfo-2.1.5-1.el8.x86_64.rpm
servicemesh-proxy-debugsource-2.1.5-1.el8.x86_64.rpm
servicemesh-ratelimit-2.1.5-1.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
Red Hat OpenShift Service Mesh 2.1.5Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
OpenShift Service Mesh 2.1 - noarch, ppc64le, s390x, x86_64
Bugs Fixed
2064857 - CVE-2022-24921 golang: regexp: stack exhaustion via a deeply nested expression
2072009 - CVE-2022-24785 Moment.js: Path traversal in moment.locale
2077688 - CVE-2022-24675 golang: encoding/pem: fix stack overflow in Decode
2077689 - CVE-2022-28327 golang: crypto/elliptic: panic caused by oversized scalar
2084085 - CVE-2022-29526 golang: syscall: faccessat checks wrong group
2092793 - CVE-2022-30629 golang: crypto/tls: session tickets lack random ticket_age_add
2105075 - CVE-2022-31129 moment: inefficient parsing algorithm resulting in DoS