An OpenShift Serverless 1.10.2 security update has been released.

RHSA-2021:2021-01: Moderate: Release of OpenShift Serverless 1.10.2 security update

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Release of OpenShift Serverless 1.10.2 security update
Advisory ID: RHSA-2021:2021-01
Product: Red Hat OpenShift Serverless
Advisory URL:   https://access.redhat.com/errata/RHSA-2021:2021
Issue date: 2021-05-19
CVE Names: CVE-2018-20843 CVE-2018-1000858 CVE-2019-5018
CVE-2019-13050 CVE-2019-13627 CVE-2019-14889
CVE-2019-15903 CVE-2019-16168 CVE-2019-16935
CVE-2019-19221 CVE-2019-19906 CVE-2019-19956
CVE-2019-20218 CVE-2019-20387 CVE-2019-20388
CVE-2019-20454 CVE-2019-20907 CVE-2019-20916
CVE-2020-1730 CVE-2020-6405 CVE-2020-7595
CVE-2020-8492 CVE-2020-9327 CVE-2020-13630
CVE-2020-13631 CVE-2020-13632 CVE-2020-14422
CVE-2021-3114 CVE-2021-3115 CVE-2021-3449
CVE-2021-3450 CVE-2021-20305
=====================================================================

1. Summary:

Openshift Serverless 1.10.2 is now available.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Serverless 1.10.2 is a generally available release of the
OpenShift Serverless Operator. This version of the OpenShift Serverless
Operator is supported on Red Hat OpenShift Container Platform version 4.5.

Security Fix(es):

* golang: crypto/elliptic: incorrect operations on the P-224 curve
(CVE-2021-3114)

* golang: cmd/go: packages using cgo can cause arbitrary code execution at
build time (CVE-2021-3115)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

See the documentation at:
  https://access.redhat.com/documentation/en-us/openshift_container_platform/
4.5/html/serverless_applications/index

4. Bugs fixed (  https://bugzilla.redhat.com/):

1918750 - CVE-2021-3114 golang: crypto/elliptic: incorrect operations on the P-224 curve
1918761 - CVE-2021-3115 golang: cmd/go: packages using cgo can cause arbitrary code execution at build time

5. References:

  https://access.redhat.com/security/cve/CVE-2018-20843
  https://access.redhat.com/security/cve/CVE-2018-1000858
  https://access.redhat.com/security/cve/CVE-2019-5018
  https://access.redhat.com/security/cve/CVE-2019-13050
  https://access.redhat.com/security/cve/CVE-2019-13627
  https://access.redhat.com/security/cve/CVE-2019-14889
  https://access.redhat.com/security/cve/CVE-2019-15903
  https://access.redhat.com/security/cve/CVE-2019-16168
  https://access.redhat.com/security/cve/CVE-2019-16935
  https://access.redhat.com/security/cve/CVE-2019-19221
  https://access.redhat.com/security/cve/CVE-2019-19906
  https://access.redhat.com/security/cve/CVE-2019-19956
  https://access.redhat.com/security/cve/CVE-2019-20218
  https://access.redhat.com/security/cve/CVE-2019-20387
  https://access.redhat.com/security/cve/CVE-2019-20388
  https://access.redhat.com/security/cve/CVE-2019-20454
  https://access.redhat.com/security/cve/CVE-2019-20907
  https://access.redhat.com/security/cve/CVE-2019-20916
  https://access.redhat.com/security/cve/CVE-2020-1730
  https://access.redhat.com/security/cve/CVE-2020-6405
  https://access.redhat.com/security/cve/CVE-2020-7595
  https://access.redhat.com/security/cve/CVE-2020-8492
  https://access.redhat.com/security/cve/CVE-2020-9327
  https://access.redhat.com/security/cve/CVE-2020-13630
  https://access.redhat.com/security/cve/CVE-2020-13631
  https://access.redhat.com/security/cve/CVE-2020-13632
  https://access.redhat.com/security/cve/CVE-2020-14422
  https://access.redhat.com/security/cve/CVE-2021-3114
  https://access.redhat.com/security/cve/CVE-2021-3115
  https://access.redhat.com/security/cve/CVE-2021-3449
  https://access.redhat.com/security/cve/CVE-2021-3450
  https://access.redhat.com/security/cve/CVE-2021-20305
  https://access.redhat.com/security/updates/classification/#moderate
  https://access.redhat.com/documentation/en-us/openshift_container_platform/4.5/html/serverless_applications/index

6. Contact:

The Red Hat security contact is . More contact
details at   https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.