-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: Red Hat OpenShift GitOps security update
Advisory ID:       RHSA-2023:5029-01
Product:           Red Hat OpenShift GitOps
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:5029
Issue date:        2023-09-08
CVE Names:         CVE-2023-2602 CVE-2023-2603 CVE-2023-2828 
                   CVE-2023-3899 CVE-2023-27536 CVE-2023-28321 
                   CVE-2023-28484 CVE-2023-29469 CVE-2023-32681 
                   CVE-2023-34969 CVE-2023-38408 CVE-2023-40029 
                   CVE-2023-40584 
=====================================================================

1. Summary:

An update is now available for Red Hat OpenShift GitOps 1.9.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Security Fix(es):

* ArgoCD: secrets can be leaked through
kubectl.kubernetes.io/last-applied-configuration (CVE-2023-40029)

* ArgoCD: Denial of Service to Argo CD repo-server (CVE-2023-40584)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2233203 - CVE-2023-40029 ArgoCD: secrets can be leak through kubectl.kubernetes.io/last-applied-configuration
2236530 - CVE-2023-40584 ArgoCD: Denial of Service to Argo CD repo-server

5. References:

https://access.redhat.com/security/cve/CVE-2023-2602
https://access.redhat.com/security/cve/CVE-2023-2603
https://access.redhat.com/security/cve/CVE-2023-2828
https://access.redhat.com/security/cve/CVE-2023-3899
https://access.redhat.com/security/cve/CVE-2023-27536
https://access.redhat.com/security/cve/CVE-2023-28321
https://access.redhat.com/security/cve/CVE-2023-28484
https://access.redhat.com/security/cve/CVE-2023-29469
https://access.redhat.com/security/cve/CVE-2023-32681
https://access.redhat.com/security/cve/CVE-2023-34969
https://access.redhat.com/security/cve/CVE-2023-38408
https://access.redhat.com/security/cve/CVE-2023-40029
https://access.redhat.com/security/cve/CVE-2023-40584
https://access.redhat.com/security/updates/classification/#critical

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJk+xy2AAoJENzjgjWX9erE2VAP/ivfRxBKoDIM7wFfWnn7McCk
A5PTqdLlwQ0GGn7OdUF0X4rAnW7dfq1BzWyPscDfRP/zzHcwnyubiDDx2oXSpr+k
GWjsaKwLQh1eD5nB6ryq1E9US8RhQPATrB3HYx9NXepngNHAiOk99K6NY5LN2B4e
uC+WBUUDWEWs0W6D49/ykdlsYIO30AkZl1fwxFM9ijyNxeQBl6XFO1z9HzDw5A8d
f8XNjHiyqCcQBgo0c2S+cENuRXRqQh2cRevG4Yh4qpURIv/ULdwpSZPFnsFgVhFw
2HEXA1S+kNVxUHClTqBVznDdAsBeG3UvL88OL1NSB1JyiGaTm8H/4BLRPUyLL/nB
btsRPbZ2B9bDsPfyTSvWo1zdzDKXrXxpFjkQox8chjek6t5+ju9+lGylplwxTyd/
oqknBF/aHFf2AlfaRrbfUwBlk7su6L2yYm9WyzaVJsP7mB8LRuHMI4GWNiSK2l/1
mvWHuv8VeFYT33iNkgDz3wOHv0jf+DpLOciz0j76wWkCdgxG/dbQkPpydAlTAPYk
ivo23HQxC0pa7z+DfWSqXcKaTeUddV137PIB4dZjbCh6u0T4LurIP+ZhQ3IQ+0sz
1VQ8zMVYkJe5Yq/dUmwY3ExYTI7jGPbuQPiJL/VP1tIDkyi6g3z7NzzM9p30yM7j
4PCLjjV8uv24ql4JUrI/
=0M3w
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2023-5029:01 Critical: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.9

Summary

Security Fix(es):
* ArgoCD: secrets can be leaked through kubectl.kubernetes.io/last-applied-configuration (CVE-2023-40029)
* ArgoCD: Denial of Service to Argo CD repo-server (CVE-2023-40584)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2023-2602 https://access.redhat.com/security/cve/CVE-2023-2603 https://access.redhat.com/security/cve/CVE-2023-2828 https://access.redhat.com/security/cve/CVE-2023-3899 https://access.redhat.com/security/cve/CVE-2023-27536 https://access.redhat.com/security/cve/CVE-2023-28321 https://access.redhat.com/security/cve/CVE-2023-28484 https://access.redhat.com/security/cve/CVE-2023-29469 https://access.redhat.com/security/cve/CVE-2023-32681 https://access.redhat.com/security/cve/CVE-2023-34969 https://access.redhat.com/security/cve/CVE-2023-38408 https://access.redhat.com/security/cve/CVE-2023-40029 https://access.redhat.com/security/cve/CVE-2023-40584 https://access.redhat.com/security/updates/classification/#critical

Package List


Severity
Advisory ID: RHSA-2023:5029-01
Product: Red Hat OpenShift GitOps
Advisory URL: https://access.redhat.com/errata/RHSA-2023:5029
Issued Date: : 2023-09-08
CVE Names: CVE-2023-2602 CVE-2023-2603 CVE-2023-2828 CVE-2023-3899 CVE-2023-27536 CVE-2023-28321 CVE-2023-28484 CVE-2023-29469 CVE-2023-32681 CVE-2023-34969 CVE-2023-38408 CVE-2023-40029 CVE-2023-40584

Topic

An update is now available for Red Hat OpenShift GitOps 1.9.Red Hat Product Security has rated this update as having a security impactof Critical. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures


Bugs Fixed

2233203 - CVE-2023-40029 ArgoCD: secrets can be leak through kubectl.kubernetes.io/last-applied-configuration

2236530 - CVE-2023-40584 ArgoCD: Denial of Service to Argo CD repo-server


Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo