Sicherheit: Mehrere Probleme in OpenShift
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in OpenShift
ID: RHSA-2021:2286-01
Distribution: Red Hat
Plattformen: Red Hat OpenShift Enterprise
Datum: Di, 15. Juni 2021, 18:17
Referenzen: https://access.redhat.com/security/cve/CVE-2021-3121
Applikationen: OKD


Hash: SHA256

Red Hat Security Advisory

Synopsis: Moderate: OpenShift Container Platform 4.7.16 security and
bug fix update
Advisory ID: RHSA-2021:2286-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2021:2286
Issue date: 2021-06-15
CVE Names: CVE-2021-3121 CVE-2021-3501 CVE-2021-3543

1. Summary:

Red Hat OpenShift Container Platform release 4.7.16 is now available with
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container
Platform 4.7.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.7.16. See the following advisories for the RPM packages for this


Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation for details about these


This update fixes the following bugs among others:

Security Fix(es):

* gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index
validation (CVE-2021-3121)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

This update also fixes several bugs. Documentation for these changes is
available from the Release Notes document linked to in the References

3. Solution:

For OpenShift Container Platform 4.7 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:


Details on how to access this content are available at
- -cli.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1889659 - [Assisted-4.6] [cluster validation] Number of hosts validation is not
enforced when Automatic role assigned
1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks
certain index validation
1932638 - Removing ssh keys MC does not remove the key from authorized_keys
1934180 - vsphere-problem-detector should check if datastore is part of
datastore cluster
1937396 - when kuryr quotas are unlimited, we should not sent alerts
1939014 - [OSP] First public endpoint is used to fetch ignition config from
Glance URL (with multiple endpoints) on OSP
1939553 - Binary file uploaded to a secret in OCP 4 GUI is not properly
converted to Base64-encoded string
1940275 - [IPI Baremetal] Revert Sending full ignition to masters
1942603 - [4.7z] Network policies in ovn-kubernetes don't support external
traffic from router when the endpoint publishing strategy is HostNetwork
1944046 - Warn users when using an unsupported browser such as IE
1944575 - Duplicate alert rules are displayed on console for thanos-querier api
return wrong results
1945702 - Operator dependency not consistently chosen from default channel
1946682 - [OVN] Source IP is not EgressIP if configured allow in the
1947091 - Incorrect skipped status for conditional tasks in the pipeline run
1947427 - Bootstrap ignition shim doesn't follow proxy settings
1948398 - [oVirt] remove ovirt_cafile from ovirt-credentials secret
1949541 - Kuryr-Controller crashes when it's missing the status object
1950290 - KubeClientCertificateExpiration alert is confusing, without
explanation in the documentation
1951210 - Pod log filename no longer in
<pod-name>-<container-name>.log format
1953475 - worker pool went degraded due to no rpm-ostree on rhel worker during
applying new mc
1954121 - [ceo] [release-4.7] Operator goes degraded when a second internal
node ip is added after install
1955210 - OCP 4.6 Build fails when filename contains an umlaut
1955418 - 4.8 -> 4.7 rollbacks broken on unrecognized flowschema
1955482 - [4.7] Drop high-cardinality metrics from kube-state-metrics which
aren't used
1955600 - e2e unidling test flakes in CI
1956565 - Need ACM Managed Cluster Info metric enabled for OCP monitoring
1956980 - OVN-Kubernetes leaves stale AddressSets around if the deletion was
1957308 - Customer tags cannot be seen in S3 level when set
spec.managementState from Managed-> Removed-> Managed in configs.imageregistry with high ratio
1957499 - OperatorHub - console accepts any value for "Infrastructure
features" annotation
1958416 - openshift-oauth-apiserver apiserver pod crashloopbackoffs
1958467 - [4.7] Webscale: sriov vfs are not created and sriovnetworknodestate
indicates sync succeeded - state is not correct
1958873 - Device Replacemet UI, The status of the disk is "replacement
ready" before I clicked on "start replacement"
1959546 - [4.7] storage-operator/vsphere-problem-detector causing upgrades to
fail that would have succeeded in past versions
1959737 - Unable to assign nodes for EgressIP even if the egress-assignable
label is set
1960093 - Console not works well against a proxy in front of openshift clusters
1960111 - Port 8080 of oVirt CSI driver is causing collisions with other
1960542 - manifests: invalid selector in ServiceMonitor makes CVO hotloop
1960544 - Overly generic CSS rules for dd and dt elements breaks styling
elsewhere in console
1960562 - manifests: invalid selector in ServiceMonitor makes CVO hotloop
1960589 - manifests: extra "spec.version" in console quickstarts makes
CVO hotloop
1960645 - [Backport 4.7] Add virt_platform metric to the collected metrics
1960686 - GlobalConfigPage is constantly requesting resources
1961069 - CMO end-to-end tests work only on AWS
1961367 - Conformance tests for OpenStack require the Cinder client that is not
included in the "tests" image
1961518 - manifests: invalid selector in ServiceMonitor makes CVO hotloop
1961557 - [release-4.7] respect the shutdown-delay-duration from
1961719 - manifests: invalid namespace in ClusterRoleBinding makes CVO hotloop
1961887 - TaskRuns Tab in PipelineRun Details Page makes cluster based calls
for TaskRuns
1962314 - openshift-marketplace pods in CrashLoopBackOff state after RHACS
installed with an SCC with readOnlyFileSystem set to true
1962493 - Kebab menu of taskrun contains Edit options which should not be
1962637 - Nodes tainted after configuring additional host iface
1962819 - OCP v4.7 installation with OVN-Kubernetes fails with error
"egress bandwidth restriction -1 is not equals"
1962949 - e2e-metal-ipi and related jobs fail to bootstrap due to multipe
1963141 - packageserver clusteroperator Available condition set to false on any
Deployment spec change
1963243 - HAproxy pod logs showing error "another server named
'pod:httpd-7c7ccfffdc-wdkvk:httpd:8080-tcp:10.128.x.x:8080' was already defined at line 326, please use distinct names"
1964322 - UI, The status of "Used Capacity Breakdown [Pods]" is
"Not available"
1964568 - Failed to upgrade from 4.6.25 to 4.7.8 due to the machine-config
1965075 - [4.7z] After upgrade from 4.5.16 to 4.6.17, customer's
application is seeing re-transmits
1965932 - [oauth-server] bump k8s.io/apiserver to 1.20.3
1966358 - Build failure on s390x
1966798 - [tests] Release 4.7 broken due to the usage of wrong OCS version
1966810 - Failing Test vendor/k8s.io/kube-aggregator/pkg/apiserver
TestProxyCertReload due to hardcoded certificate expiration
1967328 - [IBM][ROKS] Enable volume snapshot controllers on IBM Cloud
1967966 - prometheus-k8s pods can't be scheduled due to volume node
affinity conflict
1967972 - [calico] rbac-proxy container in kube-proxy fails to create
1970322 - [OVN]EgressFirewall doesn't work well as expected

5. References:


6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
Version: GnuPG v1


RHSA-announce mailing list
Pro-Linux @Facebook
Neue Nachrichten