RedHat: RHSA-2023-5447:01 Important: Migration Toolkit for Containers (MTC)
Summary
The Migration Toolkit for Containers (MTC) enables you to migrate
Kubernetes resources, persistent volume data, and internal container images
between OpenShift Container Platform clusters, using the MTC web console or
the Kubernetes API.
Security Fix(es):
* word-wrap: ReDoS (CVE-2023-26115)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
* MTC version is not displayed correctly in the UI (BZ#2233026)
* Indirect migration is stuck on backup stage (BZ#2233097)
* Migrated application unable to pull image from internal registry on
target cluster (BZ#2233103)
* PodVolumeRestore remain In Progress keeping the migration stuck at Stage
Restore (BZ#2233868)
* Migration failing on Azure due to authorization issue (BZ#2238974)
Summary
Solution
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
References
https://access.redhat.com/security/cve/CVE-2023-0800 https://access.redhat.com/security/cve/CVE-2023-0801 https://access.redhat.com/security/cve/CVE-2023-0802 https://access.redhat.com/security/cve/CVE-2023-0803 https://access.redhat.com/security/cve/CVE-2023-0804 https://access.redhat.com/security/cve/CVE-2023-2602 https://access.redhat.com/security/cve/CVE-2023-2603 https://access.redhat.com/security/cve/CVE-2023-3899 https://access.redhat.com/security/cve/CVE-2023-4863 https://access.redhat.com/security/cve/CVE-2023-5129 https://access.redhat.com/security/cve/CVE-2023-26115 https://access.redhat.com/security/cve/CVE-2023-27536 https://access.redhat.com/security/cve/CVE-2023-28321 https://access.redhat.com/security/cve/CVE-2023-28484 https://access.redhat.com/security/cve/CVE-2023-29469 https://access.redhat.com/security/cve/CVE-2023-29491 https://access.redhat.com/security/cve/CVE-2023-30630 https://access.redhat.com/security/cve/CVE-2023-32681 https://access.redhat.com/security/updates/classification/#important
Package List
Topic
The Migration Toolkit for Containers (MTC) 1.8.0 is now available.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
2216827 - CVE-2023-26115 word-wrap: ReDoS
2233026 - MTC version is not displayed correctly in the UI
2233097 - Indirect migration is stuck on backup stage
2233103 - Migrated application unable to pull image from internal registry on target cluster
2233868 - PodVolumeRestore remain In Progress keeping the migration stuck at Stage Restore
2238974 - Migration failing on Azure due to authorization issue
5. JIRA issues fixed (https://issues.redhat.com/):
MIG-1331 - MTC generates continued requests to Azure Storage API
MIG-1363 - Upgrade OADP dependency to latest version
MIG-1411 - mtc-operator specification is missing related image registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8
