-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: OpenShift Container Platform 4.10.30 bug fix and
 security update
Advisory ID:       RHSA-2022:6133-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6133
Issue date:        2022-08-31
CVE Names:         CVE-2021-3114 CVE-2021-3121 CVE-2021-3636 
                   CVE-2021-21419 CVE-2021-21623 CVE-2021-21639 
                   CVE-2021-21640 CVE-2021-21648 CVE-2021-25735 
                   CVE-2021-25737 CVE-2022-26945 CVE-2022-30321 
                   CVE-2022-30322 CVE-2022-30323 
=====================================================================

1. Summary:

Red Hat OpenShift Container Platform release 4.10.30 is now available with
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container
Platform 4.10.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.10.30. See the following advisory for the RPM packages for this
release:

https://access.redhat.com/errata/RHBA-2022:6132

Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html

Security Fix(es):

* go-getter: command injection vulnerability (CVE-2022-26945)
* go-getter: unsafe download (issue 1 of 3) (CVE-2022-30321)
* go-getter: unsafe download (issue 2 of 3) (CVE-2022-30322)
* go-getter: unsafe download (issue 3 of 3) (CVE-2022-30323)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.

You may download the oc tool and use it to inspect release image metadata
as follows:

(For x86_64 architecture)

$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.10.30-x86_64

The image digest is
sha256:7f543788330d486627c612c64eebc8e992944991e21cfdb771fd36725b277f07

(For s390x architecture)

$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.10.30-s390x

The image digest is
sha256:f18a9ef98677dbfeace3d39ee2bdbe4e1d59004b4df64ebc031214d4107c2e6b

(For ppc64le architecture)

$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.10.30-ppc64le

The image digest is
sha256:ad1e037867f067d040a35ec33d3b39bc19410da9fe91006b6217e122152a250e

(For aarch64 architecture)

$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.10.30-aarch64

The image digest is
sha256:f1b28e9c2a3e29565140b56bee2172dd5e83f3edbe683c240301155a01842f53

All OpenShift Container Platform 4.10 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift Console
or the CLI oc command. Instructions for upgrading a cluster are available
at
https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html

3. Solution:

For OpenShift Container Platform 4.10 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html

4. Bugs fixed (https://bugzilla.redhat.com/):

2051267 - When 'oc adm upgrade --to-image ...' rejects an update as not
 recommended, it should mention --allow-explicit-upgrade
2070392 - [OVN AWS] EgressIP was not balanced to another egress node after
 original node was removed egress label
2092918 - CVE-2022-30321 go-getter: unsafe download (issue 1 of 3)
2092923 - CVE-2022-30322 go-getter: unsafe download (issue 2 of 3)
2092925 - CVE-2022-30323 go-getter: unsafe download (issue 3 of 3)
2092928 - CVE-2022-26945 go-getter: command injection vulnerability
2095111 - [ovn] northd container termination script must use bash
2099584 - [Bare Metal IPI] BMH pre-provisoning netowrk configurations are not
 preserved when machineset replicas are scaled up/down
2114587 - All critical alerts should have links to a runbook
2115874 - Default catalogs fails liveness/readiness probes
2116624 - etcd-metrics container is flooding logs
2116642 - bond-cni: Backport "mac duplicates" 4.11
2116983 - flaky e2e in kube-controller-manager-operator
 TestPodDisruptionBudgetAtLimitAlert
2117351 - README file for helm charts coded in Chinese shows messy characters
 when viewing in developer perspective.
2118607 - [OVN] bonding fails after active-backup fail-over and reboot,  kargs
 static IP
2118609 - OVS-Configure doesn't iterate connection names containing spaces
 correctly

5. JIRA issues fixed (https://issues.jboss.org/):

OCPBUGS-174 - [OVN] New pods unable to establish TCP connections and get
 constant timeouts causing application downtime
OCPBUGS-200 - Exits with a non-zero code in case Etcd backup fails
OCPBUGS-205 - [release-4.10] Add support for BUILDAH_QUIET environment variable
OCPBUGS-233 - Upgrade failing because restrictive scc is injected into version
 pod
OCPBUGS-235 - ClusterVersion availableUpdates is stale: PromQL conditional
 risks vs. slow/stuck Thanos
OCPBUGS-249 - Incorrect NAT when using cluster networking in control-plane
 nodes to install a VRRP Cluster 
OCPBUGS-287 - [OVN] bonding fails after active-backup fail-over and reboot,
 kargs static IP
OCPBUGS-376 - storageclass should not be created for unsupported vsphere
 version
OCPBUGS-419 - OVS-Configure doesn't iterate connection names containing
 spaces correctly

6. References:

https://access.redhat.com/security/cve/CVE-2021-3114
https://access.redhat.com/security/cve/CVE-2021-3121
https://access.redhat.com/security/cve/CVE-2021-3636
https://access.redhat.com/security/cve/CVE-2021-21419
https://access.redhat.com/security/cve/CVE-2021-21623
https://access.redhat.com/security/cve/CVE-2021-21639
https://access.redhat.com/security/cve/CVE-2021-21640
https://access.redhat.com/security/cve/CVE-2021-21648
https://access.redhat.com/security/cve/CVE-2021-25735
https://access.redhat.com/security/cve/CVE-2021-25737
https://access.redhat.com/security/cve/CVE-2022-26945
https://access.redhat.com/security/cve/CVE-2022-30321
https://access.redhat.com/security/cve/CVE-2022-30322
https://access.redhat.com/security/cve/CVE-2022-30323
https://access.redhat.com/security/updates/classification/#important

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYw+L09zjgjWX9erEAQhCQQ/+KW4j6b7nLY/vfJRUdadPfi1mOlEL5B1F
tX6xo+RCbGW18YUeQOVQncw3r+mTdSKWYo7u+v5JjrabCcjiHFpImY0lXvicetex
H3rdlQ/nn8U+6NHLW6qeX/t0oxu3iEee/Q+jY+NetLi+OQf7uPvah3sXawzHDwWu
/Hx/UB8StPeARInkh1N9ddjD+NgtIOv7qCiAm5x/yTt3EqeUvvZFqcJymyhu58fX
KjiliGbuxo0LXb0yxjjU1xHLDCMYBkwKvyJJ4tIA97hU19NR+XqHbMUTibOEUiif
o+FteELirdelzO2Qezx0qUx0JaXpBjCbtVdKHipWwWnoNi3CmO0F1e5ccXtn1bSy
RTx66UAZlkgnV9ytr8QNcncinYgzhwO08I/mVqQnfmdJJm/bVHXXmJzROQgIv/gj
IdKsfy8r5/jQUK7Y2bREJZ8I4+t7nZEaO+BAStPycwqqlU2h0DLlfSwBtdODr1NT
5WpF3K6oVUISnc26S22k+Vc1ajq2zdvsVg0yXPwi5ZnpJMttaK1AMwgItipD5TAh
/DrtfeQE1ffGEpQG3afp9fWvboDDbUbut1BMpAkzlwFT+6UEtgWhzOT35xOV8IpY
bBx9Dl4KfGkfYEH94IjTvu6tJknoeOvXiEiyAGcyq6RV074qlPQeod6B+Z9EtoeA
WsfMJYQdyO4=
=b42+
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce