-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory
Synopsis: Moderate: [impact]: OpenShift Container Platform 4.13.13 bug fix and security update Advisory ID: RHSA-2023:5155-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2023:5155 Issue date: 2023-09-19 CVE Names: CVE-2020-22219 CVE-2023-2253 ===================================================================== 1. Summary: Red Hat OpenShift Container Platform release 4.13.13 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a security impact of [impact]. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.13.13. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2023:5158 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html Security Fix(es): * distribution/distribution: DoS from malicious API request (CVE-2023-2253) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html 3. Solution: For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:d62495768e335c79a215ba56771ff5ae97e3cbb2bf49ed8fb3f6cefabcdc0f17 (For s390x architecture) The image digest is sha256:31eed1e1c5cf788c0873d3fde09cf561c7d44d6d33b3abbeed0dcaf99ad4c24b (For ppc64le architecture) The image digest is sha256:2759c882d9493791ec8a0491e37e0d6603f48e68d2be34e512f5c64ef8b61dfe (For aarch64 architecture) The image digest is sha256:ad2a9a4beb8b0f7be75efca93a5eddb301d0b21b50d4b95685af07b653e9587d All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html 4. Bugs fixed (https://bugzilla.redhat.com/): 2189886 - CVE-2023-2253 distribution/distribution: DoS from malicious API request 5. JIRA issues fixed (https://issues.redhat.com/): OCPBUGS-14250 - [4.13] Host can get stuck on inspecting if the network secret is updated OCPBUGS-15222 - Hard coded region references remain in installer OCPBUGS-15268 - External PKI reconcilation deploys broken due to invalid dependency on additional user ca bundles OCPBUGS-16225 - Hypershift does not use probes on openshift-route-controller-manager and openshift-controller-manager OCPBUGS-17182 - olm-collect-profiles cronjob pods can't reach mgmt KAS OCPBUGS-17357 - Operator catalogs from 4.12 are used in 4.13 and 4.14 hosted clusters OCPBUGS-18192 - Dynamic plugin proxy requests time out after 30 seconds OCPBUGS-18332 - Cannot use EgressIP for the vsphere csi driver to access the vcenter api OCPBUGS-18502 - On an SNO node one of the CatalogSources gets deleted after multiple reboots 6. References: https://access.redhat.com/security/cve/CVE-2020-22219 https://access.redhat.com/security/cve/CVE-2023-2253 https://access.redhat.com/security/updates/classification/#moderate https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html 7. Contact: The Red Hat security contact is <secal...@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJlCRUBAAoJENzjgjWX9erExwIP/0D8uhnsNFNoAbWmsQ+5i346 RbQnhpBL75O5+kpZJgdEJv36+98xFEu579bR1qY9eplSsCZR9UmjdMzPW+7Spl/z KaaXjeDPEgLiw2ENKCUl672QuB/YMXeAFQqvTXMaddyuiDvIh3WIl3VF3IIemQAg 3DszUwXMuKSMvJAS21dD21WbbWJbK9MWL0+xuzDQ72CH78VEgDbhVW+tGf12EgNy 4R6Lm0yFyTc5a92JfNRfKjLCdcbgPZIuIyzBBJdIsE3DHDu91wr1q3rc/RXaqboE 63gdk2aszYnlo22dMdvyAC8MY+CB2QZH4FXKLeUQw+o52E+4CgHc+NsYUztuAjU4 RK5eTf38hllweuggdDKWYMcrkVrMDrq956GtG8QuNUiUja7ibwqOo5atf+WbS4mn k57wGxY1YrkZefRq4Y+1IFp7x/zxJC/uKmtb7ZjEc8rz2rLttygBZDmjJUy4la3f WErcmz+4hSK0tIPSOFQotTpDcVCJWfvBEf6UkjM23o+Q0pVF3vhpMENCoPt1fx+V TiAh41ziI4pCGhHif2+ias+x1MwHRyVXjbEWCV4jFt75hfGBUFj5KEfTjzgbXdnp Yk2//wNWo8HsQd8d01NIJSLgjC691ObrpBkTrClF9D44WpbtDuLHqkg4THVD65ZV E0umDVihCoxzPjnsmc0c =6QY6 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce