Stay Secure with the Latest Linux Advisories

security advisoryimportant updateCVE issues

Red Hat OpenStack 16.1 Advisory RHSA-2022-0270 Critical Etcd Issues

An update for etcd is now available for Red Hat OpenStack Platform 16.1 (Train). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenStack Platform 16.1 (etcd) security update Advisory ID: RHSA-2022:0260-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2022:0260 Issue date: 2022-01-25 CVE Names: CVE-2021-29923 CVE-2021-34558 CVE-2021-44716 ==================================================================== 1. Summary: An update for etcd is now available for Red Hat OpenStack Platform 16.1 (Train). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 16.1 - ppc64le, x86_64 3. Description: A highly-available key value store for shared configuration Security Fix(es): * net/http: limit growth of header canonicalization cache (CVE-2021-44716) * net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet (CVE-2021-29923) * crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1983596 - CVE-2021-34558golang: crypto/tls: certificate of wrong type is causing TLS client to panic 1992006 - CVE-2021-29923 golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet 2030801 - CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache 6. Package List: Red Hat OpenStack Platform 16.1: Source: etcd-3.3.23-7.el8ost.src.rpm ppc64le: etcd-3.3.23-7.el8ost.ppc64le.rpm etcd-debuginfo-3.3.23-7.el8ost.ppc64le.rpm etcd-debugsource-3.3.23-7.el8ost.ppc64le.rpm x86_64: etcd-3.3.23-7.el8ost.x86_64.rpm etcd-debuginfo-3.3.23-7.el8ost.x86_64.rpm etcd-debugsource-3.3.23-7.el8ost.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2021-29923 https://access.redhat.com/security/cve/CVE-2021-34558 https://access.redhat.com/security/cve/CVE-2021-44716 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYfAw5tzjgjWX9erEAQjvlA//XHwnJib/gTaRbdfmurdQ6CLAqjPNUI3X Q5Fo71k+ic/cBWlXWHdkkEKwt4iv+JFmDadhpBM5EzdkGKKj83sfuQc0Hiq3Ew8H v7gzqRyzosDT1zC7FOi8B3AurWlOy/EpNjloI+08enKBta5zaVTYoE3nmrVpLR58 v1gjISRvnF4m35wUPGSidb8VA/SuxBB00H6lh43z+M+xICOzTdI/9q/v12JoxXTc /onIeY0iS1B41A6IFdvBfuKoEIB3X27dJTvkYuUftJ/W+VmVvl+0UxJ/WjWOj3iG nB18xOZ6l0nKZA7M5dHWWSTkL7dLzRppN+UleiUMbZIrcUS3GSHNBmpD0U9yomzy cw0wMWZycab+qfHkIiXBXlOMlPuj853bCmiGUIWCMTUeoCeXBguxwCXtyMPWBxK3 zP6XgaQDegZOrUrzd93WJE9J37J2dGNhBSXuiK3dgSf2UKHfIBoX58dn7C4DnELb NJqh8/ZfiP2kHGjC9CIAEy2ZstWcZFvH/lWEektuZpPDjJfeXkF8Et+wQ9fgh35i NU0cDYIpx194VnRpTWi0rD9G8UqRjKh8HVa7v1djtNMt+ChQSeAV+sgG75LK5wJZ iTWk9UbQaYBhi0jCc68xVecxocsXSF8gqeWirpggkLS9zwVIJqxE8dERNN4KD3/X 0U4nZRx05ho=gpYx -----END PGP SIGNATURE----- -- RHSA-announce mailinglist This email address is being protected from spambots. You need JavaScript enabled to view it. . Canonical announces a significant security patch for Ubuntu 22.04 (kernel) aimed at mitigating critical vulnerabilities.. Red Hat OpenStack, Etcd Update, Security Impact, Important Advisory. . Severity: Important. LinuxSecurity.com Team

Jan 25, 2022 •Important Red Hat