-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: Red Hat OpenShift GitOps security update
Advisory ID:       RHSA-2023:0803-01
Product:           Red Hat OpenShift GitOps
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:0803
Issue date:        2023-02-17
CVE Names:         CVE-2021-4238 CVE-2022-3064 CVE-2022-23521 
                   CVE-2022-40303 CVE-2022-40304 CVE-2022-41903 
                   CVE-2022-47629 CVE-2023-23947 
====================================================================
1. Summary:

An update is now available for Red Hat OpenShift GitOps 1.7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Security Fix(es):

* goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as
random as they should be (CVE-2021-4238)

* go-yaml: Improve heuristics preventing CPU/memory abuse by parsing
malicious or large YAML documents (CVE-2022-3064)

* ArgoCD: Users with any cluster secret update access may update
out-of-bounds cluster secrets (CVE-2023-23947)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2156729 - CVE-2021-4238 goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be
2163037 - CVE-2022-3064 go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents
2167819 - CVE-2023-23947 ArgoCD: Users with any cluster secret update access may update out-of-bounds cluster secrets

5. References:

https://access.redhat.com/security/cve/CVE-2021-4238
https://access.redhat.com/security/cve/CVE-2022-3064
https://access.redhat.com/security/cve/CVE-2022-23521
https://access.redhat.com/security/cve/CVE-2022-40303
https://access.redhat.com/security/cve/CVE-2022-40304
https://access.redhat.com/security/cve/CVE-2022-41903
https://access.redhat.com/security/cve/CVE-2022-47629
https://access.redhat.com/security/cve/CVE-2023-23947
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY+8eptzjgjWX9erEAQhUsg//XiUcpqnLag7kYJ95BmzCB3k/67MJ2k8A
bhaIaDM464gSsNS/Z+HfJmaHR6OaOweD724SuNHT20kjP0M+PksgXhnB0xUdI6Lg
h/nWdA9U7G1ZVvjvPSLVBo1Khc7UgKUHh1vUu9HlyPnBs0PFiFoRRfLGphN5Pr7F
g1Xtu06skcLInL5hQCh/4Z4kbJXRkEOe0ElbvJP4TbAo8vE6bCbOWXJ2IGOc6JjN
acleF1PQpGg1KmGW3o462hHWFKLPXAipq98oLb3+gsQznM3ikk/k0pRDKUSLizd1
5jMkYTt0C3Lg054nymX+2fT4hCAfLxHzbf6KJMIhzK2TEqNsATZv/W2brk0UNk5v
O5/YesqwFrOSmbY/eCCe3aMzUwxijEDcrNFlcjXcOo1arE0N2bn7Nmp61p8+LHTZ
bdYuvJnSiz63tnosAlSrEJkJOEYnOUFmDqg8pfFwem86+JWAYb5AO4Vq9KHoE7C7
WCITb0k0o7Maxa2ppm0XOJ9RH109uOmFWPPu7dpxfeBQKzYYjISapZWmDd7hJ2UA
50VJSTasFVGOcXyMYGgVSOlbDNE+hXGolVjRbiXYnguSDQaNXC4X4jYex1cCawtu
25V2zWLvXhMF77ymNhLJkAc7LpcS8C0Yp6MXkHd/qj72RTtBmMCG5fRD/HqY46Ox
Fo6kwtEgc98=utEH
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2023-0803:01 Important: Red Hat OpenShift GitOps security

An update is now available for Red Hat OpenShift GitOps 1.7

Summary

Security Fix(es):
* goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be (CVE-2021-4238)
* go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)
* ArgoCD: Users with any cluster secret update access may update out-of-bounds cluster secrets (CVE-2023-23947)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2021-4238 https://access.redhat.com/security/cve/CVE-2022-3064 https://access.redhat.com/security/cve/CVE-2022-23521 https://access.redhat.com/security/cve/CVE-2022-40303 https://access.redhat.com/security/cve/CVE-2022-40304 https://access.redhat.com/security/cve/CVE-2022-41903 https://access.redhat.com/security/cve/CVE-2022-47629 https://access.redhat.com/security/cve/CVE-2023-23947 https://access.redhat.com/security/updates/classification/#important

Package List


Severity
Advisory ID: RHSA-2023:0803-01
Product: Red Hat OpenShift GitOps
Advisory URL: https://access.redhat.com/errata/RHSA-2023:0803
Issued Date: : 2023-02-17
CVE Names: CVE-2021-4238 CVE-2022-3064 CVE-2022-23521 CVE-2022-40303 CVE-2022-40304 CVE-2022-41903 CVE-2022-47629 CVE-2023-23947

Topic

An update is now available for Red Hat OpenShift GitOps 1.7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures


Bugs Fixed

2156729 - CVE-2021-4238 goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be

2163037 - CVE-2022-3064 go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents

2167819 - CVE-2023-23947 ArgoCD: Users with any cluster secret update access may update out-of-bounds cluster secrets


Related News