-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Moderate: Migration Toolkit for Containers (MTC) 1.5.4 security update
Advisory ID:       RHSA-2022:1396-01
Product:           Red Hat Migration Toolkit
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:1396
Issue date:        2022-04-19
CVE Names:         CVE-2014-3577 CVE-2019-5827 CVE-2019-13750 
                   CVE-2019-13751 CVE-2019-17594 CVE-2019-17595 
                   CVE-2019-18218 CVE-2019-19603 CVE-2019-20838 
                   CVE-2020-12762 CVE-2020-13435 CVE-2020-14155 
                   CVE-2020-16135 CVE-2020-24370 CVE-2020-25709 
                   CVE-2020-25710 CVE-2021-0920 CVE-2021-3200 
                   CVE-2021-3426 CVE-2021-3445 CVE-2021-3521 
                   CVE-2021-3572 CVE-2021-3580 CVE-2021-3800 
                   CVE-2021-3999 CVE-2021-4122 CVE-2021-4154 
                   CVE-2021-20231 CVE-2021-20232 CVE-2021-21684 
                   CVE-2021-22876 CVE-2021-22898 CVE-2021-22925 
                   CVE-2021-23177 CVE-2021-28153 CVE-2021-31566 
                   CVE-2021-33560 CVE-2021-36084 CVE-2021-36085 
                   CVE-2021-36086 CVE-2021-36087 CVE-2021-36221 
                   CVE-2021-41190 CVE-2021-42574 CVE-2021-44716 
                   CVE-2021-44717 CVE-2021-45960 CVE-2021-46143 
                   CVE-2022-0261 CVE-2022-0318 CVE-2022-0330 
                   CVE-2022-0359 CVE-2022-0361 CVE-2022-0392 
                   CVE-2022-0413 CVE-2022-0435 CVE-2022-0492 
                   CVE-2022-0516 CVE-2022-0532 CVE-2022-0778 
                   CVE-2022-0847 CVE-2022-22816 CVE-2022-22817 
                   CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 
                   CVE-2022-22825 CVE-2022-22826 CVE-2022-22827 
                   CVE-2022-22942 CVE-2022-23218 CVE-2022-23219 
                   CVE-2022-23308 CVE-2022-23852 CVE-2022-24407 
                   CVE-2022-25235 CVE-2022-25236 CVE-2022-25315 
====================================================================
1. Summary:

The Migration Toolkit for Containers (MTC) 1.5.4 is now available.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

The Migration Toolkit for Containers (MTC) enables you to migrate
Kubernetes resources, persistent volume data, and internal container images
between OpenShift Container Platform clusters, using the MTC web console or
the Kubernetes API.

Security Fix(es):

* golang: net/http/httputil: panic due to racy read of persistConn after
handler panic (CVE-2021-36221)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

3. Solution:

For details on how to install and use MTC, refer to:

https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1995656 - CVE-2021-36221 golang: net/http/httputil: panic due to racy read of persistConn after handler panic

5. References:

https://access.redhat.com/security/cve/CVE-2014-3577
https://access.redhat.com/security/cve/CVE-2019-5827
https://access.redhat.com/security/cve/CVE-2019-13750
https://access.redhat.com/security/cve/CVE-2019-13751
https://access.redhat.com/security/cve/CVE-2019-17594
https://access.redhat.com/security/cve/CVE-2019-17595
https://access.redhat.com/security/cve/CVE-2019-18218
https://access.redhat.com/security/cve/CVE-2019-19603
https://access.redhat.com/security/cve/CVE-2019-20838
https://access.redhat.com/security/cve/CVE-2020-12762
https://access.redhat.com/security/cve/CVE-2020-13435
https://access.redhat.com/security/cve/CVE-2020-14155
https://access.redhat.com/security/cve/CVE-2020-16135
https://access.redhat.com/security/cve/CVE-2020-24370
https://access.redhat.com/security/cve/CVE-2020-25709
https://access.redhat.com/security/cve/CVE-2020-25710
https://access.redhat.com/security/cve/CVE-2021-0920
https://access.redhat.com/security/cve/CVE-2021-3200
https://access.redhat.com/security/cve/CVE-2021-3426
https://access.redhat.com/security/cve/CVE-2021-3445
https://access.redhat.com/security/cve/CVE-2021-3521
https://access.redhat.com/security/cve/CVE-2021-3572
https://access.redhat.com/security/cve/CVE-2021-3580
https://access.redhat.com/security/cve/CVE-2021-3800
https://access.redhat.com/security/cve/CVE-2021-3999
https://access.redhat.com/security/cve/CVE-2021-4122
https://access.redhat.com/security/cve/CVE-2021-4154
https://access.redhat.com/security/cve/CVE-2021-20231
https://access.redhat.com/security/cve/CVE-2021-20232
https://access.redhat.com/security/cve/CVE-2021-21684
https://access.redhat.com/security/cve/CVE-2021-22876
https://access.redhat.com/security/cve/CVE-2021-22898
https://access.redhat.com/security/cve/CVE-2021-22925
https://access.redhat.com/security/cve/CVE-2021-23177
https://access.redhat.com/security/cve/CVE-2021-28153
https://access.redhat.com/security/cve/CVE-2021-31566
https://access.redhat.com/security/cve/CVE-2021-33560
https://access.redhat.com/security/cve/CVE-2021-36084
https://access.redhat.com/security/cve/CVE-2021-36085
https://access.redhat.com/security/cve/CVE-2021-36086
https://access.redhat.com/security/cve/CVE-2021-36087
https://access.redhat.com/security/cve/CVE-2021-36221
https://access.redhat.com/security/cve/CVE-2021-41190
https://access.redhat.com/security/cve/CVE-2021-42574
https://access.redhat.com/security/cve/CVE-2021-44716
https://access.redhat.com/security/cve/CVE-2021-44717
https://access.redhat.com/security/cve/CVE-2021-45960
https://access.redhat.com/security/cve/CVE-2021-46143
https://access.redhat.com/security/cve/CVE-2022-0261
https://access.redhat.com/security/cve/CVE-2022-0318
https://access.redhat.com/security/cve/CVE-2022-0330
https://access.redhat.com/security/cve/CVE-2022-0359
https://access.redhat.com/security/cve/CVE-2022-0361
https://access.redhat.com/security/cve/CVE-2022-0392
https://access.redhat.com/security/cve/CVE-2022-0413
https://access.redhat.com/security/cve/CVE-2022-0435
https://access.redhat.com/security/cve/CVE-2022-0492
https://access.redhat.com/security/cve/CVE-2022-0516
https://access.redhat.com/security/cve/CVE-2022-0532
https://access.redhat.com/security/cve/CVE-2022-0778
https://access.redhat.com/security/cve/CVE-2022-0847
https://access.redhat.com/security/cve/CVE-2022-22816
https://access.redhat.com/security/cve/CVE-2022-22817
https://access.redhat.com/security/cve/CVE-2022-22822
https://access.redhat.com/security/cve/CVE-2022-22823
https://access.redhat.com/security/cve/CVE-2022-22824
https://access.redhat.com/security/cve/CVE-2022-22825
https://access.redhat.com/security/cve/CVE-2022-22826
https://access.redhat.com/security/cve/CVE-2022-22827
https://access.redhat.com/security/cve/CVE-2022-22942
https://access.redhat.com/security/cve/CVE-2022-23218
https://access.redhat.com/security/cve/CVE-2022-23219
https://access.redhat.com/security/cve/CVE-2022-23308
https://access.redhat.com/security/cve/CVE-2022-23852
https://access.redhat.com/security/cve/CVE-2022-24407
https://access.redhat.com/security/cve/CVE-2022-25235
https://access.redhat.com/security/cve/CVE-2022-25236
https://access.redhat.com/security/cve/CVE-2022-25315
https://access.redhat.com/security/updates/classification/#moderate

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYl7undzjgjWX9erEAQiqnA//coS+jbyEFQN1aAdPyLbi2n3NcYI984MP
Jb+dx3PPN+OZ+W8pXqp786iVzD5rPvpuFc4M0COp+Ambsfw3VZCmGk9+R4KtiMi/
tK0GXP0A+t91IeyEhGcOcUtruivBaToMwriBCLwPGSduTy67eEYA5z50yilDWyP/
dwksdQFru9fFtNo6ssWZg0bk4+p37fxkH2RqRrVRSNlRZMqW6of1gj77mx+YBBHU
p5NOxg00+0JuUyvvzVAWRAk5i5lTETiO85uDZLhv01YzBDHnroQxj2BmprXVSneZ
U7ToSzYjTYHN3uUdO23ytBRTAB3Sw8yIlVHSoPhQBO8pBmzIh/MC3dGgwdfp/QRk
cdlVKMN4wfq9k693qVgMlUFIqGC05VMDqd5ftpVWdOlb71fxE2yCiawJeg2bgA9x
eiEiAF2mCcQgFrEQUZz3NkQ1Ck9KLlkGDDucCJldWo2JB2OgP9ZocwvlrtwuaEQF
lJ7ltPPMB/5mPuFiccqhKNP1uDU4LsMve7+eJtXvi9au/A8DCF3H5wGnufNRNxg1
o4e1BUL0e8WLkpaeqfioz+h98udNi6DRN1x9a1rs7HjKAgDneqWq1QdvWPrD1Xmw
8E5l/kiIOZgHdKV37//oF/InpGnxdO2mGHge+KSrwkMBZ05hfqhv0ika0SNcMFB2
APVsdFf7Z0E=TaCO
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce