Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: OpenShift Container Platform 4.7.5 security
and bug fix update
Advisory ID: RHSA-2021:1005-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2021:1005
Issue date: 2021-04-05
CVE Names: CVE-2021-3121 CVE-2021-20206
=====================================================================
1. Summary:
Red Hat OpenShift Container Platform release 4.7.5 is now
available with
updates to packages and images that fix several bugs and add
enhancements.
Red Hat Product Security has rated this update as having a
security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base
score, which
gives a detailed severity rating, is available for each
vulnerability from
the CVE link(s) in the References section.
2. Description:
Red Hat OpenShift Container Platform is Red Hat's cloud
computing
Kubernetes application platform solution designed for on-premise or
private
cloud deployments.
Red Hat OpenShift Container Platform is Red Hat's cloud
computing
Kubernetes application platform solution designed for on-premise or
private
cloud deployments.
This advisory contains the container images for Red Hat
OpenShift Container
Platform 4.7.5. See the following advisory for the RPM packages
for
this release:
https://access.redhat.com/errata/RHSA-2021:1006
All OpenShift Container Platform 4.7 users are advised to
upgrade to these
updated packages and images when they are available in the
appropriate
release channel. To check for available updates, use the OpenShift
Console
or the CLI oc command. Instructions for upgrading a cluster are
available
at
https://docs.openshift.com/container-platform/4.7/updating/updating-cluster
-
-between-minor.html#understanding-upgrade-channels_updating-cluster-between
- -minor
Security Fix(es):
* gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain
index
validation (CVE-2021-3121)
* containernetworking-cni: Arbitrary path injection via type
field in CNI
configuration (CVE-2021-20206)
For more details about the security issue(s), including the
impact, a CVSS
score, acknowledgments, and other related information, refer to the
CVE
page(s) listed in the References section.
Additional Changes:
This update also fixes several bugs. Documentation for these
changes is
available from the Release Notes document linked to in the
References
section.
You may download the oc tool and use it to inspect release image
metadata
as follows:
(For x86_64 architecture)
$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.6.20-x86_64
The image digest is
sha256:0a4c44daf1666f069258aa983a66afa2f3998b78ced79faa6174e0a0f438f0a5
(For s390x architecture)
$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.6.20-s390x
The image digest is
sha256:3fc802aafb72402768bbf1b19ce7c6de95256e5cc50799390e63f40d96cec3cd
(For ppc64le architecture)
$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.6.20-ppc64le
The image digest is
sha256:5cf6b61198337cd0950e63296be4e48e991721ac17c625f7fd77cf557f08efc7
3. Solution:
For OpenShift Container Platform 4.7 see the following
documentation, which
will be updated shortly for this release, for important
instructions on how
to upgrade your cluster and fully apply this asynchronous errata
update:
https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel
ease-notes.html
Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.7/updating/updating-cluster
- -cli.html.
4. Bugs fixed (https://bugzilla.redhat.com/):
1917904 - [release-4.7] bump k8s.io/apiserver to 1.20.3
1919391 - CVE-2021-20206 containernetworking-cni: Arbitrary path
injection via type field in CNI configuration
1921650 - CVE-2021-3121 gogo/protobuf:
plugin/unmarshal/unmarshal.go lacks certain index validation
1925792 - "Edit Annotation" are not correctly translated in
Chinese
1927198 - [e2e][automation] Fix pvc string in pvc.view
1927311 - Performance: Console makes unnecessary requests for en-US
messages on load
1927953 -
[sig-network-edge][Conformance][Area:Networking][Feature:Router]
The HAProxy router should be able to connect to a service that is
idled because a GET on the route will unidle it
1928151 - Manually misspelled as Manualy
1928614 - NTO may fail to disable stalld when relying on Tuned
'[service]' plugin
1929118 - Update plugins and Jenkins version to prepare
openshift-sync-plugin 1.0.46 release
1929246 - Missing info for Operational Status, Provisioning status,
BMC, Hostname, ID for BMH for OCP deployed with assisted
installer
1929674 - [sig-network] pods should successfully create sandboxes
by getting pod
1931382 - Pipelines shown in edit flow for Workloads created via
ContainerImage flow
1931520 - multicast traffic is not working on ovn-kubernetes
1931622 - LoadBalancer service check test fails during vsphere
upgrade
1931856 - ServiceAccount Registry Authfiles Do Not Contain Entries
for Public Hostnames
1932268 - ovn-kubernetes endpoint slice controller doesn't run on
CI jobs
1932272 - Items marked as mandatory in KMS Provider form are not
enforced
1932277 - Create new pool with arbiter - wrong replica
1932806 - release-4.7: e2e: test OAuth API connections in the tests
by that name
1933205 - /usr/lib/dracut/modules.d/30ignition/ignition --version
sigsev
1933665 - Getting Forbidden for image in a container template when
creating a sample app
1934442 - [release-4.7] Gather info about unhealthy SAP pods
1935070 - (release-4.7) Extend OLM operator gatherer to include
Operator/ClusterServiceVersion conditions
1935180 - [4.7z] IGMP/MLD packets being dropped
1935605 - [Backport 4.7] Add memory and uptime metadata to IO
archive
1935672 - pipelinerun status icon rendering issue
1935707 - test: Detect when the master pool is still updating after
upgrade
1936337 - console operator panics in DefaultDeployment with nil
cm
1936802 - (release-4.7) Authentication log gatherer shouldn't scan
all the pod logs in the openshift-authentication namespace
1936975 - VSphereProblemDetectorControllerDegraded: context
canceled during upgrade to 4.7.0
1937089 - cluster DNS experiencing disruptions during cluster
upgrade in insights cluster
1937214 - Ingress operator performs spurious updates in response to
API's defaulting of NodePort service's clusterIPs field
1937356 - Incorrect imagestream is shown as selected in knative
service container image edit flow
1937375 - [release-4.7] When deploying the operator via OLM (after
creating the respective catalogsource), the deployment "lost" the
`resources` section.
1938316 - [sig-instrumentation][Late] Alerts shouldn't report any
alerts in firing state apart from Watchdog and
AlertmanagerReceiversNotConfigured: Prometheus query error
1938921 - Router HAProxy config file template is slow to render due
to repetitive regex compilations
1938960 - Permissive Egress NetworkPolicy (0.0.0.0/0) is blocking
all traffic
1939061 - [release-4.7] Sap license management logs gatherer
4.7
1939199 - move to go 1.15 and registry.ci.openshift.org
1939608 - FilterToolbar component does not handle 'null' value for
'rowFilters' prop
1940052 - Not all image pulls within OpenShift builds retry
1940806 - [4.7z] CNO: nodes and masters are upgrading
simultaneously
1940866 - Add BareMetalPlatformType into e2e upgrade service
unsupported list
1941128 - fix co upgradeableFalse status and reason
1941217 - Bare-metal operator is firing for ClusterOperatorDown for
15m during 4.6 to 4.7 upgrade
1941246 - Openshift-apiserver CO unavailable during cluster upgrade
from 4.6 to 4.7
1941367 - The containerruntimecontroller doesn't roll back to CR-1
if we delete CR-2
1941468 - (release-4.7) 'More about Insights' link points to
support link
1941574 -
[sig-network-edge][Conformance][Area:Networking][Feature:Router]
The HAProxy router should be able to connect to a service that is
idled because a GET on the route will unidle it
[Suite:openshift/conformance/parallel/minimal]
1942059 - `oc adm catalog mirror` doesn't work for the air-gapped
cluster
1942068 - [release-4.7] Gahter datahubs.installers.datahub.sap.com
resources from SAP clusters
1943310 - [SCALE] enable OVN DB memory trimming on compaction
5. References:
https://access.redhat.com/security/cve/CVE-2021-3121
https://access.redhat.com/security/cve/CVE-2021-20206
https://access.redhat.com/security/updates/classification/#moderate
6. Contact:
The Red Hat security contact is <
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYGsbdtzjgjWX9erEAQi9Jg//XinGV4VTRIg1jiwdm/c5YjRoEZYln/VI
ITJC7jjMO9TUyuV6WUbllthmxY7uMP/YX0LC6YyC6+7MECUta0sOqN37O2RIFdyV
VQFEzGlpNEIRIUUWM16ZCGX7om5RNFWXtBrya9/oYxNR5ftQr3MY1sO77xCE2tfs
ij0WXVMX+5V0RX2SCy5USSNTWW8ZPk8EasR3yv/rw6jeVo+AnW99plSg8lrHNlWk
Zwo6BlRkO7HGt4gkD+ECBMdKm8ND4ZUx7pcKophVRueNAsFk1M2UCpQC+WpQmXXF
1HNhwCR31HNc5lkR7nfgTDKQRsyzD1N5O4UTdmh1bnMFsgcGE37NX0dmysKPUYuh
DUuI3qc85PfkNb3/9vJvyo+r79/D5s8xsFYbHAXqYlbdeKKS13ztSsxirhwWsZ7x
jwX+UbKrt/PKTVZyyq80VPVeZvLhl/Jq8lJ9BaYEp6BROKqS6lpie7wLayZTxSWS
tCuxO0zoye/HkOzkaWLc9tygVzdJZ/aaDxtMJ+B/nghsv7w+w5/CS9RCqJiFPAz+
t9BkXKWFcqD+fpzjCmSYi4FgG3sFEeSQDIfZlm0+QyVp88tp6Xf96trYqTYdvh7e
1/dn8Wc5zN29Lv7nl5w+Mb+91cZweKQ6a8XbcZGu3v8t0Xs48u0DcYLImvqI7H+4
6Lr59pNFewo=
=qhQn
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Read more https://packetstormsecurity.com/files/162082/RHSA-2021-1005-01.txt