-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Release of OpenShift Serverless Logic 1.30.0 SP1 security update
Advisory ID:       RHSA-2023:5480-01
Product:           Red Hat OpenShift Serverless
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:5480
Issue date:        2023-10-05
CVE Names:         CVE-2023-2602 CVE-2023-2603 CVE-2023-4853 
                   CVE-2023-22006 CVE-2023-22036 CVE-2023-22041 
                   CVE-2023-22044 CVE-2023-22045 CVE-2023-22049 
                   CVE-2023-25193 CVE-2023-27536 CVE-2023-28321 
                   CVE-2023-28484 CVE-2023-29469 CVE-2023-29491 
                   CVE-2023-34969 
=====================================================================

1. Summary:

Release of OpenShift Serverless Operator 1.30.1 and OpenShift Serverless
Logic 1.30.0 SP1

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE links in the References section.

2. Description:

Red Hat OpenShift Serverless release of OpenShift Serverless Logic.

This release includes security fixes.

Security Fix(es):

* quarkus: HTTP security policy bypass (CVE-2023-4853)

For further information about CVE-2023-4853, see the Red Hat Security
Bulletin link in the References section.

For more details about the security issues, including the impact, a CVSS
score, acknowledgements, and other related information, refer to the CVE
pages listed in the References section.

3. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2238034 - CVE-2023-4853 quarkus: HTTP security policy bypass

5. References:

https://access.redhat.com/security/cve/CVE-2023-2602
https://access.redhat.com/security/cve/CVE-2023-2603
https://access.redhat.com/security/cve/CVE-2023-4853
https://access.redhat.com/security/cve/CVE-2023-22006
https://access.redhat.com/security/cve/CVE-2023-22036
https://access.redhat.com/security/cve/CVE-2023-22041
https://access.redhat.com/security/cve/CVE-2023-22044
https://access.redhat.com/security/cve/CVE-2023-22045
https://access.redhat.com/security/cve/CVE-2023-22049
https://access.redhat.com/security/cve/CVE-2023-25193
https://access.redhat.com/security/cve/CVE-2023-27536
https://access.redhat.com/security/cve/CVE-2023-28321
https://access.redhat.com/security/cve/CVE-2023-28484
https://access.redhat.com/security/cve/CVE-2023-29469
https://access.redhat.com/security/cve/CVE-2023-29491
https://access.redhat.com/security/cve/CVE-2023-34969
https://access.redhat.com/security/vulnerabilities/RHSB-2023-002
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html/serverless/index
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.12/html/serverless/index
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/serverless/index

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJlHypBAAoJENzjgjWX9erEKGkP/jYGGRUGra0tizCgOISt3wpS
YKNeBdag+cSMriReV9XSse2/SYWd0CXtynbDZfQYyP7EmXik03/7Rf/o5h92OJ4c
jxrJF4mCmc0dFW31HEefguylonyMKp75XFZb0+hnAaFU4BfjzNIw8DpOcF3JP7Q7
revr5B95oWRHcfG/Wy+9g0texu7ilFlYR5Hp3eYbntkstfpOMIYHjnvYF7fDN9Ty
4AG6aAUnR0UOT5rEZE9GtGaeK+MIMbR8bnjud+NcCuYXktnGNTMhUxEa8uguh7pM
Q7hG+n6cAOYKb3kGkhCMwrfRE0TrFgkbQ0r4PoFsWll6TEV5UdBRDE5KCnUxBDjU
9CweYlI1veEx/dfpR17bOgtik6RaRsku3mUp4+3Arp8i5MMUFCWC20oyi382T/NA
EpkehRCOJk0PWgYsZ8jvPlJqgitgrpN4rIyljN4utTxFlTyZlVJyYLXPcRg0/N3t
4gFaIFqtrgumLmfgrMe6/PqmA8mRcZENsZiDeoB/zxdOGLZ4lJpgZt2/gOjONWkL
A6P+XhzLfp5BVUf4HCua2pQnk/W96ooKabsvhTc1kGb7z8f09JuNxLTIiaj+m7Jt
EMwqNxjH3hpoRF2XfOvVR0IM/G26siMpxHkqof9YA8I/St2HDpCKFn7B/ofQRMni
9J9AvIfhEJHOpvztziJH
=zYgu
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2023-5480:01 Important: Release of OpenShift Serverless Logic

Release of OpenShift Serverless Operator 1.30.1 and OpenShift Serverless Logic 1.30.0 SP1 Red Hat Product Security has rated this update as having a security impact of Important

Summary

Red Hat OpenShift Serverless release of OpenShift Serverless Logic.
This release includes security fixes.
Security Fix(es):
* quarkus: HTTP security policy bypass (CVE-2023-4853)
For further information about CVE-2023-4853, see the Red Hat Security Bulletin link in the References section.
For more details about the security issues, including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE pages listed in the References section.



Summary


Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2023-2602 https://access.redhat.com/security/cve/CVE-2023-2603 https://access.redhat.com/security/cve/CVE-2023-4853 https://access.redhat.com/security/cve/CVE-2023-22006 https://access.redhat.com/security/cve/CVE-2023-22036 https://access.redhat.com/security/cve/CVE-2023-22041 https://access.redhat.com/security/cve/CVE-2023-22044 https://access.redhat.com/security/cve/CVE-2023-22045 https://access.redhat.com/security/cve/CVE-2023-22049 https://access.redhat.com/security/cve/CVE-2023-25193 https://access.redhat.com/security/cve/CVE-2023-27536 https://access.redhat.com/security/cve/CVE-2023-28321 https://access.redhat.com/security/cve/CVE-2023-28484 https://access.redhat.com/security/cve/CVE-2023-29469 https://access.redhat.com/security/cve/CVE-2023-29491 https://access.redhat.com/security/cve/CVE-2023-34969 https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html/serverless/index https://access.redhat.com/documentation/en-us/openshift_container_platform/4.12/html/serverless/index https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/serverless/index

Package List


Severity
Advisory ID: RHSA-2023:5480-01
Product: Red Hat OpenShift Serverless
Advisory URL: https://access.redhat.com/errata/RHSA-2023:5480
Issued Date: : 2023-10-05
CVE Names: CVE-2023-2602 CVE-2023-2603 CVE-2023-4853 CVE-2023-22006 CVE-2023-22036 CVE-2023-22041 CVE-2023-22044 CVE-2023-22045 CVE-2023-22049 CVE-2023-25193 CVE-2023-27536 CVE-2023-28321 CVE-2023-28484 CVE-2023-29469 CVE-2023-29491 CVE-2023-34969

Topic

Release of OpenShift Serverless Operator 1.30.1 and OpenShift ServerlessLogic 1.30.0 SP1Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE links in the References section.


Topic


 

Relevant Releases Architectures


Bugs Fixed

2238034 - CVE-2023-4853 quarkus: HTTP security policy bypass


Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo