RedHat RHSA-2022:6345-01 Moderate: Multicluster Engine DoS and Bug Fixes
red hat
September 6, 2022
Multicluster Engine v2.1 Red Hat Product Security has rated this update as having a security impact of Moderate
Solution
For multicluster engine for Kubernetes, see the following documentation for
details on how to install the images:
Summary
Multicluster engine for Kubernetes 2.1 images
Multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
Security fixes:
* CVE-2022-31129 moment: inefficient parsing algorithm resulting in DoS
* CVE-2022-1705 golang: net/http: improper sanitization of
Transfer-Encoding header
* CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
* CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
* CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
* CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
* CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
* CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal
* CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode
* CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy -
omit X-Forwarded-For not working
* CVE-2022-30629 golang: crypto/tls: session tickets lack random
ticket_age_add
Bug fixes:
* MCE 2.1.0 Images (BZ# 2090907)
* cluster-proxy-agent not able to startup (BZ# 2109394)
* Create cluster button skips Infrastructure page, shows blank page (BZ#
2110713)
* AWS Icon sometimes doesn't show up in create cluster wizard (BZ# 2110734)
* Infrastructure descriptions in create cluster catalog should be
consistent and clear (BZ# 2110811)
* The user with clusterset view permission should not able to update the
namespace binding with the pencil icon on clusterset details page (BZ#
2111483)
* hypershift cluster creation -> not all agent labels are shown in the node
pools screen (BZ# 2112326)
* CIM - SNO expansion, worker node status incorrect (BZ# 2114735)
* Wizard fields are not pre-filled after picking credentials (BZ# 2117163)
* ManagedClusterImageRegistry CR is wrong in pure MCE env
References
https://access.redhat.com/security/cve/CVE-2022-1292 https://access.redhat.com/security/cve/CVE-2022-1586 https://access.redhat.com/security/cve/CVE-2022-1705 https://access.redhat.com/security/cve/CVE-2022-1962 https://access.redhat.com/security/cve/CVE-2022-2068 https://access.redhat.com/security/cve/CVE-2022-2097 https://access.redhat.com/security/cve/CVE-2022-2526 https://access.redhat.com/security/cve/CVE-2022-28131 https://access.redhat.com/security/cve/CVE-2022-29154 https://access.redhat.com/security/cve/CVE-2022-30629 https://access.redhat.com/security/cve/CVE-2022-30630 https://access.redhat.com/security/cve/CVE-2022-30631 https://access.redhat.com/security/cve/CVE-2022-30632 https://access.redhat.com/security/cve/CVE-2022-30633 https://access.redhat.com/security/cve/CVE-2022-30635 https://access.redhat.com/security/cve/CVE-2022-31129 https://access.redhat.com/security/cve/CVE-2022-32148 https://access.redhat.com/security/cve/CVE-2022-32206 https://access.redhat.com/security/cve/CVE-2022-32208 https://access.redhat.com/security/updates/classification/#moderate
Package List
PREVIOUS
NEXT
Advisory ID: RHSA-2022:6345-01
Product: multicluster engine for Kubernetes
Advisory URL: https://access.redhat.com/errata/RHSA-2022:6345
Issue date: 2022-09-06
Topic
Multicluster Engine v2.1Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Relevant Releases Architectures
Bugs Fixed
2090907 - MCE 2.1.0 Images
2092793 - CVE-2022-30629 golang: crypto/tls: session tickets lack random ticket_age_add
2105075 - CVE-2022-31129 moment: inefficient parsing algorithm resulting in DoS
2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
2107371 - CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
2107374 - CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
2107376 - CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
2107383 - CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
2107386 - CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
2107388 - CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode
2107390 - CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
2107392 - CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal
2109394 - cluster-proxy-agent not able to startup
2111483 - The user with clusterset view permission should not able to update the namespace binding with the pencil icon on clusterset details page
2112326 - [UI] hypershift cluster creation -> not all agent labels are shown in the node pools screen
2114735 - [UI] CIM - SNO expansion, worker node status incorrect
2117163 - [UI] Wizard fields are not pre-filled after picking credentials
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!