Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

RedHat: RHSA-2023-5447-01 Important: Migration Toolkit 1.8.0 Security

red hat
Calendar Grey October 5, 2023
Dist Redhat Esm H88
The latest security update for Red Hat's Migration Toolkit for Containers 1.8.0 resolves significant vulnerabilities and improves overall functionality.
The Migration Toolkit for Containers (MTC) 1.8.0 is now available

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API.
Security Fix(es):
* word-wrap: ReDoS (CVE-2023-26115)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* MTC version is not displayed correctly in the UI (BZ#2233026)
* Indirect migration is stuck on backup stage (BZ#2233097)
* Migrated application unable to pull image from internal registry on target cluster (BZ#2233103)
* PodVolumeRestore remain In Progress keeping the migration stuck at Stage Restore (BZ#2233868)
* Migration failing on Azure due to authorization issue (BZ#2238974)

Topics%20covered

Topics Covered

security advisory security update Red Hat bug fix important Kubernetes migration toolkit

References

https://access.redhat.com/security/cve/CVE-2023-0800 https://access.redhat.com/security/cve/CVE-2023-0801 https://access.redhat.com/security/cve/CVE-2023-0802 https://access.redhat.com/security/cve/CVE-2023-0803 https://access.redhat.com/security/cve/CVE-2023-0804 https://access.redhat.com/security/cve/CVE-2023-2602 https://access.redhat.com/security/cve/CVE-2023-2603 https://access.redhat.com/security/cve/CVE-2023-3899 https://access.redhat.com/security/cve/CVE-2023-4863 https://access.redhat.com/security/cve/CVE-2023-5129 https://access.redhat.com/security/cve/CVE-2023-26115 https://access.redhat.com/security/cve/CVE-2023-27536 https://access.redhat.com/security/cve/CVE-2023-28321 https://access.redhat.com/security/cve/CVE-2023-28484 https://access.redhat.com/security/cve/CVE-2023-29469 https://access.redhat.com/security/cve/CVE-2023-29491 https://access.redhat.com/security/cve/CVE-2023-30630 https://access.redhat.com/security/cve/CVE-2023-32681 https://access.redhat.com/security/updates/classification/#important

Package List


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2023:5447-01
Product: Red Hat Migration Toolkit
Advisory URL: https://access.redhat.com/errata/RHSA-2023:5447
Issue date: 2023-10-05

Topic

The Migration Toolkit for Containers (MTC) 1.8.0 is now available.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security update Red Hat bug fix important Kubernetes migration toolkit

Relevant Releases Architectures

Bugs Fixed

2216827 - CVE-2023-26115 word-wrap: ReDoS

2233026 - MTC version is not displayed correctly in the UI

2233097 - Indirect migration is stuck on backup stage

2233103 - Migrated application unable to pull image from internal registry on target cluster

2233868 - PodVolumeRestore remain In Progress keeping the migration stuck at Stage Restore

2238974 - Migration failing on Azure due to authorization issue

5. JIRA issues fixed (https://redhat.atlassian.net/jira/projects):

MIG-1331 - MTC generates continued requests to Azure Storage API

MIG-1363 - Upgrade OADP dependency to latest version

MIG-1411 - mtc-operator specification is missing related image registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here