-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: Red Hat OpenShift GitOps security update
Advisory ID:       RHSA-2023:0804-01
Product:           Red Hat OpenShift GitOps
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:0804
Issue date:        2023-02-17
CVE Names:         CVE-2021-4238 CVE-2022-3064 CVE-2022-23521 
                   CVE-2022-40303 CVE-2022-40304 CVE-2022-41903 
                   CVE-2022-47629 CVE-2023-23947 
====================================================================
1. Summary:

An update is now available for Red Hat OpenShift GitOps 1.5.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Security Fix(es):

* goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as
random as they should be (CVE-2021-4238)

* go-yaml: Improve heuristics preventing CPU/memory abuse by parsing
malicious or large YAML documents (CVE-2022-3064)

* ArgoCD: Users with any cluster secret update access may update
out-of-bounds cluster secrets (CVE-2023-23947)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2156729 - CVE-2021-4238 goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be
2163037 - CVE-2022-3064 go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents
2167819 - CVE-2023-23947 ArgoCD: Users with any cluster secret update access may update out-of-bounds cluster secrets

5. References:

https://access.redhat.com/security/cve/CVE-2021-4238
https://access.redhat.com/security/cve/CVE-2022-3064
https://access.redhat.com/security/cve/CVE-2022-23521
https://access.redhat.com/security/cve/CVE-2022-40303
https://access.redhat.com/security/cve/CVE-2022-40304
https://access.redhat.com/security/cve/CVE-2022-41903
https://access.redhat.com/security/cve/CVE-2022-47629
https://access.redhat.com/security/cve/CVE-2023-23947
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY+8eo9zjgjWX9erEAQiOPg/+OeivacdZq0CEDwRXRWJKJPfz3IyrcHFH
JEcqXIU1Oxp3BBgPZ7ZhledPaNHB2W+LPiZPe9Qm4S8N0lFdcFs7Cq00Aptrz7cn
YXyfYVKarruo5blzb771wdhFQP7PoryVvkbqUK6Kv1uPGHjBk0pv/Gbq6ClsXtdz
E7BnH6zL37WObwLVy8d9Ex8PWXlzF4UaHE0sJtnf1wvsBDSISPc/YNv63KIabOE7
CV0KppbJ7ViOR8bEFB333vyc9HBLfIQ2of7SdcbeB8sLS55sC0V2JxiRvjcgTSHZ
OTW1rS6eKq+1GnViCSYI2diqEEYgJaIjuKAW8l6AAGIPCfRHQ92yqqWCSzrBWczL
XXVYQRzjcDwnpjfG1ubF6mf6uf4cbyDiRkT1/uGFerjQb82WfXH5Vv47Yjryw2iX
u/G0gnP63xIBKH6r/uQUuX/S0RK6zzLj6+Dcgqs6/Qn+YITaeNcJQt+7rVRexz0P
fk01LzB/i6HAaoWdpnoG/LBvUsfcIpvmVDAl12wFuU6yuNV/E5E+fvHvEQqIIt3c
MGQKn2e+epGZ3+3qv6Ma4GnKjqJCEvdWSiolE2QV7VsKi+sp6223G2wmjRqUKMGC
xDQ2D5BjXkHmKMUUCY9pCKlY486fDKJDkTvVu2oK1kOBOq8jYELfI5OBu8jh1Tgu
SkBkF1ACbh0=5vpQ
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2023-0804:01 Important: Red Hat OpenShift GitOps security

An update is now available for Red Hat OpenShift GitOps 1.5

Summary

Security Fix(es):
* goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be (CVE-2021-4238)
* go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)
* ArgoCD: Users with any cluster secret update access may update out-of-bounds cluster secrets (CVE-2023-23947)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2021-4238 https://access.redhat.com/security/cve/CVE-2022-3064 https://access.redhat.com/security/cve/CVE-2022-23521 https://access.redhat.com/security/cve/CVE-2022-40303 https://access.redhat.com/security/cve/CVE-2022-40304 https://access.redhat.com/security/cve/CVE-2022-41903 https://access.redhat.com/security/cve/CVE-2022-47629 https://access.redhat.com/security/cve/CVE-2023-23947 https://access.redhat.com/security/updates/classification/#important

Package List


Severity
Advisory ID: RHSA-2023:0804-01
Product: Red Hat OpenShift GitOps
Advisory URL: https://access.redhat.com/errata/RHSA-2023:0804
Issued Date: : 2023-02-17
CVE Names: CVE-2021-4238 CVE-2022-3064 CVE-2022-23521 CVE-2022-40303 CVE-2022-40304 CVE-2022-41903 CVE-2022-47629 CVE-2023-23947

Topic

An update is now available for Red Hat OpenShift GitOps 1.5.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures


Bugs Fixed

2156729 - CVE-2021-4238 goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be

2163037 - CVE-2022-3064 go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents

2167819 - CVE-2023-23947 ArgoCD: Users with any cluster secret update access may update out-of-bounds cluster secrets


Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo