Issued:: 2022-05-11
Updated:: 2022-05-11

RHSA-2022:2183 - Moderate: Release of containers for OSP 16.2.z director operator tech preview

Synopsis

Moderate: Release of containers for OSP 16.2.z director operator tech preview

Type/Severity

Security Advisory Moderate

Topic

Red Hat OpenStack Platform 16.2 (Train) director Operator containers are available for technology preview.

Description

Release osp-director-operator images

Security Fix(es):

golang: kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote (CVE-2019-11253)
golang: golang-github-miekg-dns: predictable TXID can lead to response forgeries (CVE-2019-19794)
golang: containerd: unrestricted access to abstract Unix domain socket can lead to privileges (CVE-2020-15257)
golang: ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)
golang: containerd: pulling and extracting crafted container image may result in Unix file permission changes (CVE-2021-32760)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.

Solution

OSP 16.2 Release - OSP Director Operator Containers tech preview

Affected Products

Product	Version	Arch
Red Hat OpenStack	16.2	x86_64

Fixes

CVEs

References

https://access.redhat.com/security/updates/classification/#moderate

Additional information

The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.