RedHat: RHSA-2022-7201:01 Important: OpenShift Container Platform 4...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: OpenShift Container Platform 4.11.12 security update
Advisory ID:       RHSA-2022:7201-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:7201
Issue date:        2022-11-02
CVE Names:         CVE-2020-35525 CVE-2020-35527 CVE-2022-0494 
                   CVE-2022-1353 CVE-2022-2509 CVE-2022-2588 
                   CVE-2022-3515 CVE-2022-23816 CVE-2022-23825 
                   CVE-2022-26945 CVE-2022-29900 CVE-2022-29901 
                   CVE-2022-30321 CVE-2022-30322 CVE-2022-30323 
                   CVE-2022-32742 CVE-2022-37434 CVE-2022-40674 
                   CVE-2022-41974 
=====================================================================

1. Summary:

Red Hat OpenShift Container Platform release 4.11.12 is now available with
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.11.12. See the following advisory for the RPM packages for this
release:

https://access.redhat.com/errata/RHBA-2022:7200

Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html

Security Fix(es):

* go-getter: command injection vulnerability (CVE-2022-26945)
* go-getter: unsafe download (issue 1 of 3) (CVE-2022-30321)
* go-getter: unsafe download (issue 2 of 3) (CVE-2022-30322)
* go-getter: unsafe download (issue 3 of 3) (CVE-2022-30323)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

You may download the oc tool and use it to inspect release image metadata
as follows:

(For x86_64 architecture)

$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.11.12-x86_64

The image digest is
sha256:0ca14e0f692391970fc23f88188f2a21f35a5ba24fe2f3cb908fd79fa46458e6

(For s390x architecture)

$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.11.12-s390x

The image digest is
sha256:7b9b21e35286e67473a0c4c28c84e3d806eb30364682a6b072b79109c2d22c6b

(For ppc64le architecture)

$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.11.12-ppc64le

The image digest is
sha256:c61315b1257695b5f86d2782a70909227e004cd7cd30236c6f94a9e4ecf24ecb

(For aarch64 architecture)

$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.11.12-aarch64

The image digest is
sha256:c70dc68aef64280d3cba9a056af29438943b30c260a7156893e1bae5c6c5ce3f

All OpenShift Container Platform 4.11 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift Console
or the CLI oc command. Instructions for upgrading a cluster are available
at
https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html

3. Solution:

For OpenShift Container Platform 4.11 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html

4. Bugs fixed (https://bugzilla.redhat.com/):

2042826 - [SNO] the replicas of ingresscontroller/default is 2 on new installed SNO private cluster
2092839 - Downward API (annotations) is missing PCI information when using the tuning metaPlugin on SR-IOV Networks
2092918 - CVE-2022-30321 go-getter: unsafe download (issue 1 of 3)
2092923 - CVE-2022-30322 go-getter: unsafe download (issue 2 of 3)
2092925 - CVE-2022-30323 go-getter: unsafe download (issue 3 of 3)
2092928 - CVE-2022-26945 go-getter: command injection vulnerability
2099800 - Bump to kubernetes 1.24.6
2109487 - machine-controller is case sensitive which can lead to false/positive errors

5. JIRA issues fixed (https://issues.jboss.org/):

OCPBUGS-1099 - Missing  $SEARCH domain in /etc/resolve.conf for OCP v4.9.31 cluster 
OCPBUGS-1346 - OpenStack UPI scripts do not create server group for Computes
OCPBUGS-1658 - Whereabouts should allow non default interfaces to Pod IP list [backport 4.11]
OCPBUGS-1713 - Kuryr-Controller Restarting on KuryrPort with missing pod
OCPBUGS-1955 - [4.11] Dual stack cluster fails on installation when multi-path routing entries exist
OCPBUGS-1972 - [IPI on Baremetal] ipv6 support issue in metal3-httpd
OCPBUGS-1984 - Install Helm chart form doesn't allow the user select a specific version
OCPBUGS-2011 - [4.11] ironic clear_job_queue and reset_idrac pending issues
OCPBUGS-2014 - CI: Backend unit tests fails because devfile registry was updated (mock response)
OCPBUGS-2042 - [2102088] 4.11 CatalogSourcesUnhealthy error in subscription When upgrading ptp-operator
OCPBUGS-2046 - Remove policy/v1beta1 in 4.11 and later
OCPBUGS-2050 - [release-4.11] DNS operator does not reconcile the openshift-dns namespace
OCPBUGS-2092 - Use floating tags in golang imagestream
OCPBUGS-2112 - [release-4.11] Address e2e failures due to pod security
OCPBUGS-2113 - [4.11] etcd and kube-apiserver pods get restarted due to failed liveness probes while deleting/re-creating pods on SNO
OCPBUGS-2140 - member loses rights after some other user login in openid / group sync
OCPBUGS-2293 - CVO skips reconciling the installed optional resources in the 4.11 to 4.12 upgrade
OCPBUGS-2320 - [release-4.11] Remove namespace and name from gathered DVO metrics
OCPBUGS-2451 - e2e tests: Installs Red Hat Integration - 3scale operator test is failing due to change of Operator name
OCPBUGS-2528 - dns-default pod missing "target.workload.openshift.io/management:" annotation
OCPBUGS-2606 - [release-4.11] go.mod should beworking with golang-1.17 and golang-1.18
OCPBUGS-2616 - e2e-gcp-builds is permafailing
OCPBUGS-2626 - Worker creation fails within provider networks (as primary and secondary)
OCPBUGS-2640 - prometheus-k8s-0 ends in CrashLoopBackOff with evel=error err="opening storage failed: /prometheus/chunks_head/000002: invalid magic number 0" on SNO after hard reboot tests
OCPBUGS-2658 - [4.11] VPA E2Es fail due to CSV name mismatch
OCPBUGS-2766 - 'oc login' should be robust in the face of gather failures
OCPBUGS-2780 - Import: Advanced option sentence is splited into two parts and headlines has no padding
OCPBUGS-449 - KubeDaemonSetRolloutStuck alert using incorrect metric in 4.9 and 4.10
OCPBUGS-526 - Prerelease report bug link should be updated to JIRA instead of Bugzilla
OCPBUGS-668 - Prefer local dns does not work expectedly on OCPv4.11
OCPBUGS-673 - crio occasionally fails to start during deployment
OCPBUGS-689 - [2112237] [ Cluster storage Operator 4.x(10/11) ] DefaultStorageClassController report fake message "No default StorageClass for this platform" on Alicloud, IBM
OCPBUGS-744 - [4.11] Spoke BMH stuck ?provisioning? after changing a BIOS attribute via the converged workflow
OCPBUGS-947 - [4.11] Rebase openshift/etcd 4.11 onto 3.5.5
OCPBUGS-955 - [2087981] PowerOnVM_Task is deprecated use PowerOnMultiVM_Task for DRS ClusterRecommendation

6. References:

https://access.redhat.com/security/cve/CVE-2020-35525
https://access.redhat.com/security/cve/CVE-2020-35527
https://access.redhat.com/security/cve/CVE-2022-0494
https://access.redhat.com/security/cve/CVE-2022-1353
https://access.redhat.com/security/cve/CVE-2022-2509
https://access.redhat.com/security/cve/CVE-2022-2588
https://access.redhat.com/security/cve/CVE-2022-3515
https://access.redhat.com/security/cve/CVE-2022-23816
https://access.redhat.com/security/cve/CVE-2022-23825
https://access.redhat.com/security/cve/CVE-2022-26945
https://access.redhat.com/security/cve/CVE-2022-29900
https://access.redhat.com/security/cve/CVE-2022-29901
https://access.redhat.com/security/cve/CVE-2022-30321
https://access.redhat.com/security/cve/CVE-2022-30322
https://access.redhat.com/security/cve/CVE-2022-30323
https://access.redhat.com/security/cve/CVE-2022-32742
https://access.redhat.com/security/cve/CVE-2022-37434
https://access.redhat.com/security/cve/CVE-2022-40674
https://access.redhat.com/security/cve/CVE-2022-41974
https://access.redhat.com/security/updates/classification/#important

7. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY2JozNzjgjWX9erEAQhHwxAAidAR052/ozo/ov6l13JeYEuIF/01JhB9
P3L3rcLhNk76PR8A7gPu4UR/Ws5Jx3htFMMxWwtWGr13zpmI0KN3aFiJo5HMT07o
Ug8TuPI66U4d5VVGhd9ihecdoYGPnRMlGVLLhIczRpnPHC960VaS9+6wUHs8Wu/S
Du9QcuPRI8SD1sFsWZ2XPy0X6OJDkflDL1aDHQnaM6E3uajNR1lqBafZplToyPzz
x5yB79lxz28E2/7qMFaarp9hvrel8mlXHZ3jh1K6yeLLJ/o/rxnbgyJNY2WEAnsM
/ygqoZ+MAHAdkID38gc5vFzT75JDWfuouMrmhw6j58eb/SN4pLo1/iL9OQdKFuWs
rQwJ4NsopoTnI1VV1awYIblPvYjK9/3MtL/denrMVgLONTvOLMSROuLtGNVeUSTZ
VIxTV70wtT7Dn6rAfQYb35y9mfzDrQVoR01kRqlhPULUx0qPvaU+tVmXTwUShDCL
/98LZUalebsbdwETs/vzEFMZDspBdrI0gEgbtWN1v3n2LrYaLuC+6+5THOB2zsgh
c+vY5iR4rIh6bPRR8b79MkKWpibO2aJjuY/V/cthtVF5ZixYO4fXtmlFR010uzfV
5Lcbt74wOOJGrcLtqtwjBLqPDzye2lkB92ukLGOKDIiJ/GyLy1trhJGjsC/xjrCx
92G318cSZhU=
=qJeD
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-7201:01 Important: OpenShift Container Platform 4.11.12

Red Hat OpenShift Container Platform release 4.11.12 is now available with updates to packages and images that fix several bugs and add enhancements

Summary

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.12. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2022:7200
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html
Security Fix(es):
* go-getter: command injection vulnerability (CVE-2022-26945) * go-getter: unsafe download (issue 1 of 3) (CVE-2022-30321) * go-getter: unsafe download (issue 2 of 3) (CVE-2022-30322) * go-getter: unsafe download (issue 3 of 3) (CVE-2022-30323)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
You may download the oc tool and use it to inspect release image metadata as follows:
(For x86_64 architecture)
$ oc adm release info quay.io/openshift-release-dev/ocp-release:4.11.12-x86_64
The image digest is sha256:0ca14e0f692391970fc23f88188f2a21f35a5ba24fe2f3cb908fd79fa46458e6
(For s390x architecture)
$ oc adm release info quay.io/openshift-release-dev/ocp-release:4.11.12-s390x
The image digest is sha256:7b9b21e35286e67473a0c4c28c84e3d806eb30364682a6b072b79109c2d22c6b
(For ppc64le architecture)
$ oc adm release info quay.io/openshift-release-dev/ocp-release:4.11.12-ppc64le
The image digest is sha256:c61315b1257695b5f86d2782a70909227e004cd7cd30236c6f94a9e4ecf24ecb
(For aarch64 architecture)
$ oc adm release info quay.io/openshift-release-dev/ocp-release:4.11.12-aarch64
The image digest is sha256:c70dc68aef64280d3cba9a056af29438943b30c260a7156893e1bae5c6c5ce3f
All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html

Solution

For OpenShift Container Platform 4.11 see the following documentation,which will be updated shortly for this release, for important instructionson how to upgrade your cluster and fully apply this asynchronous errataupdate:https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.htmlDetails on how to access this content are available athttps://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html

References

https://access.redhat.com/security/cve/CVE-2020-35525 https://access.redhat.com/security/cve/CVE-2020-35527 https://access.redhat.com/security/cve/CVE-2022-0494 https://access.redhat.com/security/cve/CVE-2022-1353 https://access.redhat.com/security/cve/CVE-2022-2509 https://access.redhat.com/security/cve/CVE-2022-2588 https://access.redhat.com/security/cve/CVE-2022-3515 https://access.redhat.com/security/cve/CVE-2022-23816 https://access.redhat.com/security/cve/CVE-2022-23825 https://access.redhat.com/security/cve/CVE-2022-26945 https://access.redhat.com/security/cve/CVE-2022-29900 https://access.redhat.com/security/cve/CVE-2022-29901 https://access.redhat.com/security/cve/CVE-2022-30321 https://access.redhat.com/security/cve/CVE-2022-30322 https://access.redhat.com/security/cve/CVE-2022-30323 https://access.redhat.com/security/cve/CVE-2022-32742 https://access.redhat.com/security/cve/CVE-2022-37434 https://access.redhat.com/security/cve/CVE-2022-40674 https://access.redhat.com/security/cve/CVE-2022-41974 https://access.redhat.com/security/updates/classification/#important

Package List

Severity
Advisory ID: RHSA-2022:7201-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2022:7201
Issued Date: : 2022-11-02
CVE Names: CVE-2020-35525 CVE-2020-35527 CVE-2022-0494 CVE-2022-1353 CVE-2022-2509 CVE-2022-2588 CVE-2022-3515 CVE-2022-23816 CVE-2022-23825 CVE-2022-26945 CVE-2022-29900 CVE-2022-29901 CVE-2022-30321 CVE-2022-30322 CVE-2022-30323 CVE-2022-32742 CVE-2022-37434 CVE-2022-40674 CVE-2022-41974

Topic

Red Hat OpenShift Container Platform release 4.11.12 is now available withupdates to packages and images that fix several bugs and add enhancements.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Relevant Releases Architectures

Bugs Fixed

2042826 - [SNO] the replicas of ingresscontroller/default is 2 on new installed SNO private cluster

2092839 - Downward API (annotations) is missing PCI information when using the tuning metaPlugin on SR-IOV Networks

2092918 - CVE-2022-30321 go-getter: unsafe download (issue 1 of 3)

2092923 - CVE-2022-30322 go-getter: unsafe download (issue 2 of 3)

2092925 - CVE-2022-30323 go-getter: unsafe download (issue 3 of 3)

2092928 - CVE-2022-26945 go-getter: command injection vulnerability

2099800 - Bump to kubernetes 1.24.6

2109487 - machine-controller is case sensitive which can lead to false/positive errors

5. JIRA issues fixed (https://issues.jboss.org/):

OCPBUGS-1099 - Missing $SEARCH domain in /etc/resolve.conf for OCP v4.9.31 cluster

OCPBUGS-1346 - OpenStack UPI scripts do not create server group for Computes

OCPBUGS-1658 - Whereabouts should allow non default interfaces to Pod IP list [backport 4.11]

OCPBUGS-1713 - Kuryr-Controller Restarting on KuryrPort with missing pod

OCPBUGS-1955 - [4.11] Dual stack cluster fails on installation when multi-path routing entries exist

OCPBUGS-1972 - [IPI on Baremetal] ipv6 support issue in metal3-httpd

OCPBUGS-1984 - Install Helm chart form doesn't allow the user select a specific version

OCPBUGS-2011 - [4.11] ironic clear_job_queue and reset_idrac pending issues

OCPBUGS-2014 - CI: Backend unit tests fails because devfile registry was updated (mock response)

OCPBUGS-2042 - [2102088] 4.11 CatalogSourcesUnhealthy error in subscription When upgrading ptp-operator

OCPBUGS-2046 - Remove policy/v1beta1 in 4.11 and later

OCPBUGS-2050 - [release-4.11] DNS operator does not reconcile the openshift-dns namespace

OCPBUGS-2092 - Use floating tags in golang imagestream

OCPBUGS-2112 - [release-4.11] Address e2e failures due to pod security

OCPBUGS-2113 - [4.11] etcd and kube-apiserver pods get restarted due to failed liveness probes while deleting/re-creating pods on SNO

OCPBUGS-2140 - member loses rights after some other user login in openid / group sync

OCPBUGS-2293 - CVO skips reconciling the installed optional resources in the 4.11 to 4.12 upgrade

OCPBUGS-2320 - [release-4.11] Remove namespace and name from gathered DVO metrics

OCPBUGS-2451 - e2e tests: Installs Red Hat Integration - 3scale operator test is failing due to change of Operator name

OCPBUGS-2528 - dns-default pod missing "target.workload.openshift.io/management:" annotation

OCPBUGS-2606 - [release-4.11] go.mod should beworking with golang-1.17 and golang-1.18

OCPBUGS-2616 - e2e-gcp-builds is permafailing

OCPBUGS-2626 - Worker creation fails within provider networks (as primary and secondary)

OCPBUGS-2640 - prometheus-k8s-0 ends in CrashLoopBackOff with evel=error err="opening storage failed: /prometheus/chunks_head/000002: invalid magic number 0" on SNO after hard reboot tests

OCPBUGS-2658 - [4.11] VPA E2Es fail due to CSV name mismatch

OCPBUGS-2766 - 'oc login' should be robust in the face of gather failures

OCPBUGS-2780 - Import: Advanced option sentence is splited into two parts and headlines has no padding

OCPBUGS-449 - KubeDaemonSetRolloutStuck alert using incorrect metric in 4.9 and 4.10

OCPBUGS-526 - Prerelease report bug link should be updated to JIRA instead of Bugzilla

OCPBUGS-668 - Prefer local dns does not work expectedly on OCPv4.11

OCPBUGS-673 - crio occasionally fails to start during deployment

OCPBUGS-689 - [2112237] [ Cluster storage Operator 4.x(10/11) ] DefaultStorageClassController report fake message "No default StorageClass for this platform" on Alicloud, IBM

OCPBUGS-744 - [4.11] Spoke BMH stuck ?provisioning? after changing a BIOS attribute via the converged workflow

OCPBUGS-947 - [4.11] Rebase openshift/etcd 4.11 onto 3.5.5

OCPBUGS-955 - [2087981] PowerOnVM_Task is deprecated use PowerOnMultiVM_Task for DRS ClusterRecommendation

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.