Issued:
2023-01-30
Updated:
2023-01-30

RHSA-2023:0542 - Important: Red Hat OpenShift Service Mesh 2.3.1 Containers security update

Synopsis

Important: Red Hat OpenShift Service Mesh 2.3.1 Containers security update

Type/Severity

Security Advisory Important

Topic

Red Hat OpenShift Service Mesh 2.3.1 Containers

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Service Mesh is the Red Hat distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.

This advisory covers container images for the release.

Security Fix(es):

  • goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be (CVE-2021-4238)
  • golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)
  • golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
  • golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
  • Istio: Denial of service attack via a specially crafted message (CVE-2022-39278)
  • golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
  • kiali: error message spoofing in kiali UI (CVE-2022-3962)
  • golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, see the CVE page(s) listed in the Container CVEs section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

ProductVersionArch
Red Hat OpenShift Service Mesh2x86_64
Red Hat OpenShift Service Mesh for Power2ppc64le
Red Hat OpenShift Service Mesh for IBM Z2s390x

Fixes

CVEs

References

Additional information