Stay Secure with the Latest Linux Advisories

security advisorymoderatesecurity update

Red Hat Service Interconnect 1.4 RHSA-2023-4003-01 Moderate: Network Issues

This is release 1.4 of the rpms for Red Hat Service Interconnect. Red Hat Service Interconnect 1.4 introduces a service network, linking TCP and HTTP services across the hybrid cloud. A service network enables communication between services running in. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Service Interconnect 1.4 Release security update Advisory ID: RHSA-2023:4003-01 Product: Red Hat Service Interconnect Advisory URL: https://access.redhat.com/errata/RHSA-2023:4003 Issue date: 2023-07-10 CVE Names: CVE-2022-2879 CVE-2022-2880 CVE-2022-28327 CVE-2022-41715 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-29400 ==================================================================== 1. Summary: This is release 1.4 of the rpms for Red Hat Service Interconnect. Red Hat Service Interconnect 1.4 introduces a service network, linking TCP and HTTP services across the hybrid cloud. A service network enables communication between services running in different network locations or sites. It allows geographically distributed services to connect as if they were all running in the same site. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: 8Base-Service-Interconnect-1 - noarch, x86_64 9Base-Service-Interconnect-1 - noarch, x86_64 3. Description: As a Kubernetes user, I cannot connect easily connect services from one cluster with services on another cluster. Red Hat Application Interconnect enables me to create aservice network and it allows geographically distributed services to connect as if they were all running in the same site. Security Fix(es): * golang: archive/tar: unbounded memory consumption when reading headers(CVE-2022-2879) * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880) * golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327) * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715) * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723) * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724) * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725) * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) * golang: go/parser: Infinite loop in parsing (CVE-2023-24537) * golang: html/template: backticks not treated as string delimiters(CVE-2023-24538) * golang: html/template: improper sanitization of CSS values (CVE-2023-24539) * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2077689 - CVE-2022-28327 golang: crypto/elliptic: panic caused by oversized scalar 2132867 - CVE-2022-2879 golang: archive/tar: unbounded memory consumption when reading headers2132868 - CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters2132872 - CVE-2022-41715 golang:regexp/syntax: limit memory used by parsing regexps 2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding 2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption 2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics 2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption 2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation 2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing 2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values 2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes 6. PackageList: 8Base-Service-Interconnect-1: Source: libwebsockets-4.3.1-1.el8ai.src.rpm qpid-proton-0.37.0-2.el8ai.src.rpm skupper-cli-1.4.1-2.el8.src.rpm skupper-router-2.4.1-2.el8.src.rpm noarch: skupper-router-common-2.4.1-2.el8.noarch.rpm skupper-router-docs-2.4.1-2.el8.noarch.rpm skupper-router-tools-2.4.1-2.el8.noarch.rpm x86_64: libwebsockets-4.3.1-1.el8ai.x86_64.rpm libwebsockets-debuginfo-4.3.1-1.el8ai.x86_64.rpm libwebsockets-debugsource-4.3.1-1.el8ai.x86_64.rpm libwebsockets-devel-4.3.1-1.el8ai.x86_64.rpm python3-qpid-proton-0.37.0-2.el8ai.x86_64.rpm python3-qpid-proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm qpid-proton-c-0.37.0-2.el8ai.x86_64.rpm qpid-proton-c-debuginfo-0.37.0-2.el8ai.x86_64.rpm qpid-proton-c-devel-0.37.0-2.el8ai.x86_64.rpm qpid-proton-cpp-debuginfo-0.37.0-2.el8ai.x86_64.rpm qpid-proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm qpid-proton-debugsource-0.37.0-2.el8ai.x86_64.rpm rubygem-qpid_proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm skupper-cli-1.4.1-2.el8.x86_64.rpm skupper-router-2.4.1-2.el8.x86_64.rpm skupper-router-debuginfo-2.4.1-2.el8.x86_64.rpm skupper-router-debugsource-2.4.1-2.el8.x86_64.rpm 9Base-Service-Interconnect-1: Source: jsoncpp-1.9.4-3.el9.src.rpm libwebsockets-4.3.1-1.el9ai.src.rpm qpid-proton-0.37.0-2.el9ai.src.rpm skupper-cli-1.4.1-2.el9.src.rpm skupper-router-2.4.1-2.el9.src.rpm noarch: skupper-router-common-2.4.1-2.el9.noarch.rpm skupper-router-docs-2.4.1-2.el9.noarch.rpm skupper-router-tools-2.4.1-2.el9.noarch.rpm x86_64: jsoncpp-1.9.4-3.el9.x86_64.rpm jsoncpp-debuginfo-1.9.4-3.el9.x86_64.rpm jsoncpp-debugsource-1.9.4-3.el9.x86_64.rpm jsoncpp-devel-1.9.4-3.el9.x86_64.rpm libwebsockets-4.3.1-1.el9ai.x86_64.rpm libwebsockets-debuginfo-4.3.1-1.el9ai.x86_64.rpm libwebsockets-debugsource-4.3.1-1.el9ai.x86_64.rpm libwebsockets-devel-4.3.1-1.el9ai.x86_64.rpm python3-qpid-proton-0.37.0-2.el9ai.x86_64.rpm python3-qpid-proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm qpid-proton-c-0.37.0-2.el9ai.x86_64.rpm qpid-proton-c-debuginfo-0.37.0-2.el9ai.x86_64.rpm qpid-proton-c-devel-0.37.0-2.el9ai.x86_64.rpm qpid-proton-cpp-0.37.0-2.el9ai.x86_64.rpm qpid-proton-cpp-debuginfo-0.37.0-2.el9ai.x86_64.rpm qpid-proton-cpp-devel-0.37.0-2.el9ai.x86_64.rpm qpid-proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm qpid-proton-debugsource-0.37.0-2.el9ai.x86_64.rpm rubygem-qpid_proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm skupper-cli-1.4.1-2.el9.x86_64.rpm skupper-router-2.4.1-2.el9.x86_64.rpm skupper-router-debuginfo-2.4.1-2.el9.x86_64.rpm skupper-router-debugsource-2.4.1-2.el9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-2879 https://access.redhat.com/security/cve/CVE-2022-2880 https://access.redhat.com/security/cve/CVE-2022-28327 https://access.redhat.com/security/cve/CVE-2022-41715 https://access.redhat.com/security/cve/CVE-2022-41723 https://access.redhat.com/security/cve/CVE-2022-41724 https://access.redhat.com/security/cve/CVE-2022-41725 https://access.redhat.com/security/cve/CVE-2023-24534 https://access.redhat.com/security/cve/CVE-2023-24536 https://access.redhat.com/security/cve/CVE-2023-24537 https://access.redhat.com/security/cve/CVE-2023-24538 https://access.redhat.com/security/cve/CVE-2023-24539 https://access.redhat.com/security/cve/CVE-2023-29400 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_service_interconnect 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIcBAEBCAAGBQJkrCiuAAoJENzjgjWX9erEM2gP/2vUJQvf383OISO9rO36AQ/J CpvJsVopoqPsOM9efR4Wlj272mPOGAn2dih6ZBqEX2nvCwrP3yKExqhy1b6k+36M dXBG2ZAp7bLKbfp4Q+FPSBcHx/TRnS9cWkQ5O7bNroZKAxA6eqv73peiGAWf3B+L 8GHRrZkniv0X+oiWTASrziEfjuUta4GhhIQxnDMt2vAj62zN+PNTULtgOkG0o8E3 7mnL5aJ48JgaPk8SiZNlozE6gVPpUYFCkzM9IIq+LrLLS0hXSiJGv6vRB1NTMmgy 5YrXqbo/xKsZtFGJgXb3OPO+tRBvisDenkSIZ9XCeKWM/duuSXPfjctsVDgVtOkt gK6sAy9D3Tug6oXNIUZpKh0/ndyxwTjXG3GEHlQOdvuCH7OpIhkBKiDFxKbQHNqj 1tf3PmKDkArTRC7DTAD3Q+pYuDJgu5/PMBZLvp4Ok7TXODPlCKUlp+PC/CLcBi4w kmJIn6n0G05JcnBCbSV0pHY+z/QGfNQwB4AL5Pg9AAq4vYZis0nlg8OBJ8Xyih00 tzajFvLXPbJ4DJ+wcopzQFB/HJ/m/F4uH9z9+b73QigiomCs8MWLXRvfDO2GkOkK KkiPj9RWrcXBuCOwPXVVJi9/bwGPT7tufXWei+X1WwBqf537Tkg9r001EOvGtzSc LJnVw0+s1xYM+2cYsVa5 =OCZA -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Red Hat Service Mesh 2.3 brings enhancements to service communication with notable security improvements. Discover the details!. Red Hat, Service Interconnect, security update, moderate. . LinuxSecurity.com Team

Jul 10, 2023 Red Hat