—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.2180
Red Hat Advanced Cluster Management 2.2.4 security and bug fix update
18 June 2021
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: Red Hat Advanced Cluster Management 2.2.4
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Execute Arbitrary Code/Commands — Remote/Unauthenticated
Root Compromise — Existing Account
Denial of Service — Remote/Unauthenticated
Access Confidential Data — Remote/Unauthenticated
Provide Misleading Information — Remote with User Interaction
Reduced Security — Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-28918 CVE-2021-28165 CVE-2021-28163
CVE-2021-28092 CVE-2021-27219 CVE-2021-25215
CVE-2021-23336 CVE-2021-21640 CVE-2021-21639
CVE-2021-21309 CVE-2021-3543 CVE-2021-3501
CVE-2021-3347 CVE-2021-3326 CVE-2021-3177
CVE-2021-3114 CVE-2020-29363 CVE-2020-29362
CVE-2020-29361 CVE-2020-28935 CVE-2020-28362
CVE-2020-28196 CVE-2020-27619 CVE-2020-27618
CVE-2020-27170 CVE-2020-26137 CVE-2020-26116
CVE-2020-25692 CVE-2020-25648 CVE-2020-24977
CVE-2020-24332 CVE-2020-24331 CVE-2020-24330
CVE-2020-15358 CVE-2020-13776 CVE-2020-13434
CVE-2020-12364 CVE-2020-12363 CVE-2020-12362
CVE-2020-10878 CVE-2020-10543 CVE-2020-8927
CVE-2020-8648 CVE-2020-8286 CVE-2020-8285
CVE-2020-8284 CVE-2020-8231 CVE-2019-25042
CVE-2019-25041 CVE-2019-25040 CVE-2019-25039
CVE-2019-25038 CVE-2019-25037 CVE-2019-25036
CVE-2019-25035 CVE-2019-25034 CVE-2019-25032
CVE-2019-25013 CVE-2019-14866 CVE-2019-9169
CVE-2019-3842 CVE-2019-2708 CVE-2017-14502
CVE-2016-10228
Reference: ASB-2021.0089
ESB-2021.2160
ESB-2021.2157
ESB-2021.2136
ESB-2021.2134
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:2461
– ————————–BEGIN INCLUDED TEXT——————–
Red Hat Product Errata RHSA-2021:2461 – Security Advisory
Issued:
2021-06-16
Updated:
2021-06-16
RHSA-2021:2461 – Security Advisory
* Overview
* Updated Packages
Synopsis
Moderate: Red Hat Advanced Cluster Management 2.2.4 security and bug fix update
Type/Severity
Security Advisory: Moderate
Topic
Red Hat Advanced Cluster Management for Kubernetes 2.2.4 General Availability
release images, which fix several bugs and security issues.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Description
Red Hat Advanced Cluster Management for Kubernetes 2.2.4 images
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability
engineers face as they work across a range of public and private cloud
environments.
Clusters and applications are all visible and managed from a single
console?with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which fix several bugs and security issues. See
the following Release Notes documentation, which will be updated shortly for
this release, for additional details about this release:
https://access.redhat.com/documentation/en-us/
red_hat_advanced_cluster_management_for_kubernetes/2.2/html/release_notes/
Security fixes:
* redisgraph-tls: redis: integer overflow when configurable limit for maximum
supported bulk input size is too big on 32-bit platforms (CVE-2021-21309)
* console-header-container: nodejs-netmask: improper input validation of
octal input data (CVE-2021-28092)
* console-container: nodejs-is-svg: ReDoS via malicious string
(CVE-2021-28918)
Bug fixes:
* RHACM 2.2.4 images (BZ# 1957254)
* Enabling observability for OpenShift Container Storage with RHACM 2.2 on
OCP 4.7 (BZ#1950832)
* ACM Operator should support using the default route TLS (BZ# 1955270)
* The scrolling bar for search filter does not work properly (BZ# 1956852)
* Limits on Length of MultiClusterObservability Resource Name (BZ# 1959426)
* The proxy setup in install-config.yaml is not worked when IPI installing
with RHACM (BZ# 1960181)
* Unable to make SSH connection to a Bitbucket server (BZ# 1966513)
* Observability Thanos store shard crashing – cannot unmarshall DNS message
(BZ# 1967890)
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/documentation/en-us/
red_hat_advanced_cluster_management_for_kubernetes/2.2/html-single/install/
index#installing
Affected Products
* Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 8 x86_64
* Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 7 x86_64
Fixes
* BZ – 1932634 – CVE-2021-21309 redis: integer overflow when configurable
limit for maximum supported bulk input size is too big on 32-bit platforms
* BZ – 1939103 – CVE-2021-28092 nodejs-is-svg: ReDoS via malicious string
* BZ – 1944827 – CVE-2021-28918 nodejs-netmask: improper input validation of
octal input data
* BZ – 1950832 – Enabling observability for OpenShift Container Storage with
RHACM 2.2 on OCP 4.7
* BZ – 1952150 – [DDF] It would be great to see all the options available for
the bucket configuration and which attributes are mandatory
* BZ – 1954506 – [DDF] Table does not contain data about 20 clusters. Now
it’s difficult to estimate CPU usage with larger clusters
* BZ – 1954535 – Reinstall Submariner – No endpoints found on one cluster
* BZ – 1955270 – ACM Operator should support using the default route TLS
* BZ – 1956852 – The scrolling bar for search filter does not work properly
* BZ – 1957254 – RHACM 2.2.4 images
* BZ – 1959426 – Limits on Length of MultiClusterObservability Resource Name
* BZ – 1960181 – The proxy setup in install-config.yaml is not worked when
IPI installing with RHACM.
* BZ – 1963128 – [DDF] Please rename this to “Amazon Elastic Kubernetes
Service”
* BZ – 1966513 – Unable to make SSH connection to a Bitbucket server
* BZ – 1967357 – [DDF] When I clicked on this yaml, I get a HTTP 404 error.
* BZ – 1967890 – Observability Thanos store shard crashing – cannot unmarshal
DNS message
CVEs
* CVE-2016-10228
* CVE-2017-14502
* CVE-2019-2708
* CVE-2019-3842
* CVE-2019-9169
* CVE-2019-14866
* CVE-2019-25013
* CVE-2019-25032
* CVE-2019-25034
* CVE-2019-25035
* CVE-2019-25036
* CVE-2019-25037
* CVE-2019-25038
* CVE-2019-25039
* CVE-2019-25040
* CVE-2019-25041
* CVE-2019-25042
* CVE-2020-8231
* CVE-2020-8284
* CVE-2020-8285
* CVE-2020-8286
* CVE-2020-8648
* CVE-2020-8927
* CVE-2020-10543
* CVE-2020-10878
* CVE-2020-12362
* CVE-2020-12363
* CVE-2020-12364
* CVE-2020-13434
* CVE-2020-13776
* CVE-2020-15358
* CVE-2020-24330
* CVE-2020-24331
* CVE-2020-24332
* CVE-2020-24977
* CVE-2020-25648
* CVE-2020-25692
* CVE-2020-26116
* CVE-2020-26137
* CVE-2020-27170
* CVE-2020-27618
* CVE-2020-27619
* CVE-2020-28196
* CVE-2020-28362
* CVE-2020-28935
* CVE-2020-29361
* CVE-2020-29362
* CVE-2020-29363
* CVE-2021-3114
* CVE-2021-3177
* CVE-2021-3326
* CVE-2021-3347
* CVE-2021-3501
* CVE-2021-3543
* CVE-2021-21309
* CVE-2021-21639
* CVE-2021-21640
* CVE-2021-23336
* CVE-2021-25215
* CVE-2021-27219
* CVE-2021-28092
* CVE-2021-28163
* CVE-2021-28165
* CVE-2021-28918
References
* https://access.redhat.com/security/updates/classification/#moderate
Note: More recent versions of these packages may be available. Click a package
name for more details.
Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 8
SRPM
x86_64
Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 7
SRPM
x86_64
The Red Hat security contact is secalert@redhat.com. More contact details at
https://access.redhat.com/security/team/contact/.
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYMxTSONLKJtyKPYoAQiLaxAAsIS3KGpSaXKcqZswNRqODYZWFdyp47Y3
sMUGkvxR0+/b7crO9AnHUNi6Ux0+BSBV2CUfDQuQ+9I38xIHDSt21maVDH00cQvh
rCyqqgayJoqismM3ooLqTAEnHbOGziz71eL002syH0/0gN7JAoKYuQcco+hBzG58
6hXTUL9L+RyjzfFPTGh4FTkkU4QferK1uOTE9DgN/oX+p+V5ta3D2z0Qa/f/A6ko
jPd2untofcEjR8Xizr6eumMdau4+IiKoMaIuCY9UxywK0TVFrUWccINOo5MXlYVv
n22z9rkzCpywDxIrfNY3ravKY1Ao4JcRTz6KAgdEjCNEgdx3Qwbu3xJX/ulN3Ljq
dAq6YsO8NivUC6bPCI23jpuqxqajPOnxWIn5T3MQ/DSaN938lqRJlGyFRkvU4HpH
XVwBy6qlH7zJ0abkduM55ty4PM6DkNaGVasQ02LSwaVPeHwh2/LV8lwVZDB3S5HO
8anwYBKtHU87bpJPEbh65QuKblDgG1R6EvG800L8PTned1kXLjfXAV3HnaTIGnyC
7UNc491LZ+IBd6vW28BRqQY5VdoJlyYQiICSr6axdSvue64Qo5fYqBGls44HABYN
ZlI3oqWexNjBj7x2BsRLeY5A05iqXiY9VzB/zMYk/S0IYwwx24peLTi0PdVdYymi
pUaM9Vmksp8=
=kU2A
—–END PGP SIGNATURE—–
The post ESB-2021.2180 – [RedHat] Red Hat Advanced Cluster Management 2.2.4: Multiple vulnerabilities appeared first on Malware Devil.
https://malwaredevil.com/2021/06/18/esb-2021-2180-redhat-red-hat-advanced-cluster-management-2-2-4-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-2180-redhat-red-hat-advanced-cluster-management-2-2-4-multiple-vulnerabilities
No comments:
Post a Comment