RedHat: RHSA-2022-6696:01 Critical: Red Hat Advanced Cluster Management
Summary
Red Hat Advanced Cluster Management for Kubernetes 2.4.6 images
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which fix several security issues and several
bugs. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/
Security fixes:
* golang: crypto/tls: session tickets lack random ticket_age_add
(CVE-2022-30629)
* moment: inefficient parsing algorithim resulting in DoS (CVE-2022-31129)
* nodejs16: CRLF injection in node-undici (CVE-2022-31150)
* nodejs/undici: Cookie headers uncleared on cross-origin redirect
(CVE-2022-31151)
* vm2: Sandbox Escape in vm2 (CVE-2022-36067)
Bug fixes:
* RHACM 2.4 using deprecated APIs in managed clusters (BZ# 2041540)
* vSphere network name doesn't allow entering spaces and doesn't reflect
YAML changes (BZ# 2074766)
* cluster update status is stuck, also update is not even visible (BZ#
2079418)
* Policy that creates cluster role is showing as not compliant due to
Request entity too large message (BZ# 2088486)
* Upgraded from RHACM 2.22.32.4 and cannot create cluster (BZ#
2089490)
* ACM Console Becomes Unusable After a Time (BZ# 2097464)
* RHACM 2.4.6 images (BZ# 2100613)
* Cluster Pools with conflicting name of existing clusters in same
namespace fails creation and deletes existing cluster (BZ# 2102436)
* ManagedClusters in Pending import state after ACM hub migration (BZ#
2102495)
Summary
Solution
For Red Hat Advanced Cluster Management for Kubernetes, see the following
documentation, which will be updated shortly for this release, for
important
instructions on installing this update:
https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html-single/install/index#installing
References
https://access.redhat.com/security/cve/CVE-2015-20107 https://access.redhat.com/security/cve/CVE-2020-28915 https://access.redhat.com/security/cve/CVE-2021-40528 https://access.redhat.com/security/cve/CVE-2022-0391 https://access.redhat.com/security/cve/CVE-2022-1012 https://access.redhat.com/security/cve/CVE-2022-1292 https://access.redhat.com/security/cve/CVE-2022-1586 https://access.redhat.com/security/cve/CVE-2022-1729 https://access.redhat.com/security/cve/CVE-2022-1785 https://access.redhat.com/security/cve/CVE-2022-1897 https://access.redhat.com/security/cve/CVE-2022-1927 https://access.redhat.com/security/cve/CVE-2022-2068 https://access.redhat.com/security/cve/CVE-2022-2097 https://access.redhat.com/security/cve/CVE-2022-2526 https://access.redhat.com/security/cve/CVE-2022-21123 https://access.redhat.com/security/cve/CVE-2022-21125 https://access.redhat.com/security/cve/CVE-2022-21166 https://access.redhat.com/security/cve/CVE-2022-22576 https://access.redhat.com/security/cve/CVE-2022-25313 https://access.redhat.com/security/cve/CVE-2022-25314 https://access.redhat.com/security/cve/CVE-2022-27666 https://access.redhat.com/security/cve/CVE-2022-27774 https://access.redhat.com/security/cve/CVE-2022-27776 https://access.redhat.com/security/cve/CVE-2022-27782 https://access.redhat.com/security/cve/CVE-2022-29154 https://access.redhat.com/security/cve/CVE-2022-29824 https://access.redhat.com/security/cve/CVE-2022-30629 https://access.redhat.com/security/cve/CVE-2022-31129 https://access.redhat.com/security/cve/CVE-2022-31150 https://access.redhat.com/security/cve/CVE-2022-31151 https://access.redhat.com/security/cve/CVE-2022-32206 https://access.redhat.com/security/cve/CVE-2022-32208 https://access.redhat.com/security/cve/CVE-2022-32250 https://access.redhat.com/security/cve/CVE-2022-34903 https://access.redhat.com/security/cve/CVE-2022-36067 https://access.redhat.com/security/updates/classification/#critical
Package List
Topic
Red Hat Advanced Cluster Management for Kubernetes 2.4.6 GeneralAvailability release images, which fix bugs and update container images.Red Hat Product Security has rated this update as having a security impactof Critical. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
2041540 - RHACM 2.4 using deprecated APIs in managed clusters2074766 - vSphere network name doesn't allow entering spaces and doesn't reflect YAML changes
2079418 - cluster update status is stuck, also update is not even visible
2088486 - Policy that creates cluster role is showing as not compliant due to Request entity too large message
2089490 - Upgraded from RHACM 2.22.32.4 and cannot create cluster
2092793 - CVE-2022-30629 golang: crypto/tls: session tickets lack random ticket_age_add
2097464 - ACM Console Becomes Unusable After a Time
2100613 - RHACM 2.4.6 images
2102436 - Cluster Pools with conflicting name of existing clusters in same namespace fails creation and deletes existing cluster
2102495 - ManagedClusters in Pending import state after ACM hub migration
2105075 - CVE-2022-31129 moment: inefficient parsing algorithm resulting in DoS
2109354 - CVE-2022-31150 nodejs16: CRLF injection in node-undici
2121396 - CVE-2022-31151 nodejs/undici: Cookie headers uncleared on cross-origin redirect
2124794 - CVE-2022-36067 vm2: Sandbox Escape in vm2
