Red Hat Advanced Cluster Management 2.1.11 security fix and container updates has been released.
RHSA-2021:3653-01: Important: Red Hat Advanced Cluster Management 2.1.11 security fix and container updates
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat Advanced Cluster Management 2.1.11 security fix and container updates
Advisory ID: RHSA-2021:3653-01
Product: Red Hat ACM
Advisory URL: https://access.redhat.com/errata/RHSA-2021:3653
Issue date: 2021-09-23
CVE Names: CVE-2020-27777 CVE-2021-3653 CVE-2021-22555
CVE-2021-22922 CVE-2021-22923 CVE-2021-22924
CVE-2021-23017 CVE-2021-29154 CVE-2021-29650
CVE-2021-31535 CVE-2021-32399 CVE-2021-36222
CVE-2021-37750
=====================================================================
1. Summary:
Red Hat Advanced Cluster Management for Kubernetes 2.1.11 General
Availability release images, which provide a security fix and update the
container images.
Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Description:
Red Hat Advanced Cluster Management for Kubernetes 2.1.11 images
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains updates to one or more container images for Red Hat
Advanced Cluster Management for Kubernetes. See the following Release Notes
documentation, which will be updated shortly for this release, for
additional
details about this release:
https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_mana
gement_for_kubernetes/2.1/html/release_notes/
Security fix:
* management-ingress-container: nginx: Off-by-one in ngx_resolver_copy()
when labels are followed by a pointer to a root domain name
(CVE-2021-23017)
For more details about the security issue, including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Container updates:
* RHACM 2.1.11 images (BZ# 1999375)
3. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
*Important:* This upgrade of Red Hat Advanced Cluster Management for
Kubernetes
is not supported when you are running Red Hat Advanced Cluster Management
on
Red Hat OpenShift Container Platform version 4.5. To apply this upgrade,
you
must upgrade your OpenShift Container Platform version to 4.6, or later.
For details on how to apply this update, refer to:
https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_mana
gement_for_kubernetes/2.1/html/install/installing#upgrading-by-using-the-op
erator
4. Bugs fixed ( https://bugzilla.redhat.com/):
1963121 - CVE-2021-23017 nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name
1999375 - RHACM 2.1.11 images
5. References:
https://access.redhat.com/security/cve/CVE-2020-27777
https://access.redhat.com/security/cve/CVE-2021-3653
https://access.redhat.com/security/cve/CVE-2021-22555
https://access.redhat.com/security/cve/CVE-2021-22922
https://access.redhat.com/security/cve/CVE-2021-22923
https://access.redhat.com/security/cve/CVE-2021-22924
https://access.redhat.com/security/cve/CVE-2021-23017
https://access.redhat.com/security/cve/CVE-2021-29154
https://access.redhat.com/security/cve/CVE-2021-29650
https://access.redhat.com/security/cve/CVE-2021-31535
https://access.redhat.com/security/cve/CVE-2021-32399
https://access.redhat.com/security/cve/CVE-2021-36222
https://access.redhat.com/security/cve/CVE-2021-37750
https://access.redhat.com/security/updates/classification/#important
6. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
