Stay Secure with the Latest Linux Advisories

security advisoryRed Hatmoderate impact

RedHat OpenShift Service Mesh 2.1.2.1 Moderate Security Update

An update for is now available for OpenShift Service Mesh 2.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat OpenShift Service Mesh 2.1.2.1 containers security update Advisory ID: RHSA-2022:1739-01 Product: Red Hat OpenShift Service Mesh Advisory URL: https://access.redhat.com/errata/RHSA-2022:1739 Issue date: 2022-05-05 CVE Names: CVE-2021-44906 CVE-2022-0235 CVE-2022-0536 CVE-2022-0778 CVE-2022-24771 CVE-2022-24772 CVE-2022-24773 CVE-2022-25235 CVE-2022-25236 CVE-2022-25315 ==================================================================== 1. Summary: An update for is now available for OpenShift Service Mesh 2.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers the containers for the release. Security Fix(es): * minimist: prototype pollution (CVE-2021-44906) * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235) * follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536) * node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery (CVE-2022-24771) * node-forge: Signatureverification failing to check tailing garbage bytes can lead to signature forgery (CVE-2022-24772) * node-forge: Signature verification leniency in checking `DigestInfo` structure (CVE-2022-24773) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/service_mesh/service-mesh-2-x 4. Bugs fixed (https://bugzilla.redhat.com/): 2044591 - CVE-2022-0235 node-fetch: exposure of sensitive information to an unauthorized actor 2053259 - CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak 2066009 - CVE-2021-44906 minimist: prototype pollution 2067387 - CVE-2022-24771 node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery 2067458 - CVE-2022-24772 node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery 2067461 - CVE-2022-24773 node-forge: Signature verification leniency in checking `DigestInfo` structure 5. JIRA issues fixed (https://redhat.atlassian.net/jira/projects): OSSM-1435 - Container release for Maistra 2.1.2.1 6.References: https://access.redhat.com/security/cve/CVE-2021-44906 https://access.redhat.com/security/cve/CVE-2022-0235 https://access.redhat.com/security/cve/CVE-2022-0536 https://access.redhat.com/security/cve/CVE-2022-0778 https://access.redhat.com/security/cve/CVE-2022-24771 https://access.redhat.com/security/cve/CVE-2022-24772 https://access.redhat.com/security/cve/CVE-2022-24773 https://access.redhat.com/security/cve/CVE-2022-25235 https://access.redhat.com/security/cve/CVE-2022-25236 https://access.redhat.com/security/cve/CVE-2022-25315 https://access.redhat.com/security/updates/classification#moderate 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYnRM3tzjgjWX9erEAQjZ+g//daw+NHFztb9cgW1y0S30efFHVrQ2iDOv ic1hZeEFPTYXKsKFaRV5h61OmcuKt76eRmV6zzHqZFl0Fqh/Q1gMOFn4baTEMwbZ 7Mld2aTezzFis3FMNPIm3ioZCpEuFafrp18zqtzpr4YtXkVyLdSSchYSAV7XuHJV BkGYWJmZ8Y62hLctiXsDdKaKJdvHvZCYY38zOpeupFCId8vvOqPX6HH6iixg9+Qz zGcuYqmkXHjXjFO/Tpy0xxD2cQUDUt587yBgSV9i8uNyNqxAscWVMU5swXz316+V mnaFwjBbdVggpCTo7/AlPREnYDHbjtK0N4IEYg+wJ71pX/RPYJgxFdtn+zmtiUfO xTOWkLi/jdtNtqgZ1mMVAFyq+v/eJ6yrRmGhQ6OTSJATnq1+Orjj+cN9TWgKx8hD OPrG68mK8VgyAv1QjjGMJz8EnTr/XrFcXkVLDHzfDXOR6JIa8bL/dBC+lAcjIwUo SEHyvr4etRMYOP+QQOEsN0Bs+8ZiE9NngsgzAicwt4iXZqq0vRfvOzj60bscLaQp koG4SSfftSwKPZZz/kasaEIYOrWgsJOqbo5tjzICsZaMjdeNTbIxyBAK1okEVHfO omZxnp3SoMcu1VZcImXtWf7QqplFhrJZmMH3zxfI4I7ChEURH3HGi3h0ZtcwyXux ViFqVVqTRV4=EzG0 -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . New version released for Red Hat OpenShift Service Mesh 2.1.2.1 addressing moderate security vulnerabilities. Explore the details of the updates.. OpenShift Service Mesh, Red Hat, security update, moderate severity, containers fix. . LinuxSecurity.com Team

May 05, 2022 Red Hat