Red Hat 9037 Published by

A Migration Toolkit for Containers (MTC) 1.5.4 security update has been released.



RHSA-2022:1396-01: Moderate: Migration Toolkit for Containers (MTC) 1.5.4 security update



=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Migration Toolkit for Containers (MTC) 1.5.4 security update
Advisory ID: RHSA-2022:1396-01
Product: Red Hat Migration Toolkit
Advisory URL:   https://access.redhat.com/errata/RHSA-2022:1396
Issue date: 2022-04-19
CVE Names: CVE-2014-3577 CVE-2019-5827 CVE-2019-13750
CVE-2019-13751 CVE-2019-17594 CVE-2019-17595
CVE-2019-18218 CVE-2019-19603 CVE-2019-20838
CVE-2020-12762 CVE-2020-13435 CVE-2020-14155
CVE-2020-16135 CVE-2020-24370 CVE-2020-25709
CVE-2020-25710 CVE-2021-0920 CVE-2021-3200
CVE-2021-3426 CVE-2021-3445 CVE-2021-3521
CVE-2021-3572 CVE-2021-3580 CVE-2021-3800
CVE-2021-3999 CVE-2021-4122 CVE-2021-4154
CVE-2021-20231 CVE-2021-20232 CVE-2021-21684
CVE-2021-22876 CVE-2021-22898 CVE-2021-22925
CVE-2021-23177 CVE-2021-28153 CVE-2021-31566
CVE-2021-33560 CVE-2021-36084 CVE-2021-36085
CVE-2021-36086 CVE-2021-36087 CVE-2021-36221
CVE-2021-41190 CVE-2021-42574 CVE-2021-44716
CVE-2021-44717 CVE-2021-45960 CVE-2021-46143
CVE-2022-0261 CVE-2022-0318 CVE-2022-0330
CVE-2022-0359 CVE-2022-0361 CVE-2022-0392
CVE-2022-0413 CVE-2022-0435 CVE-2022-0492
CVE-2022-0516 CVE-2022-0532 CVE-2022-0778
CVE-2022-0847 CVE-2022-22816 CVE-2022-22817
CVE-2022-22822 CVE-2022-22823 CVE-2022-22824
CVE-2022-22825 CVE-2022-22826 CVE-2022-22827
CVE-2022-22942 CVE-2022-23218 CVE-2022-23219
CVE-2022-23308 CVE-2022-23852 CVE-2022-24407
CVE-2022-25235 CVE-2022-25236 CVE-2022-25315
=====================================================================

1. Summary:

The Migration Toolkit for Containers (MTC) 1.5.4 is now available.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

The Migration Toolkit for Containers (MTC) enables you to migrate
Kubernetes resources, persistent volume data, and internal container images
between OpenShift Container Platform clusters, using the MTC web console or
the Kubernetes API.

Security Fix(es):

* golang: net/http/httputil: panic due to racy read of persistConn after
handler panic (CVE-2021-36221)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

3. Solution:

For details on how to install and use MTC, refer to:

  https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html

4. Bugs fixed (  https://bugzilla.redhat.com/):

1995656 - CVE-2021-36221 golang: net/http/httputil: panic due to racy read of persistConn after handler panic

5. References:

  https://access.redhat.com/security/cve/CVE-2014-3577
  https://access.redhat.com/security/cve/CVE-2019-5827
  https://access.redhat.com/security/cve/CVE-2019-13750
  https://access.redhat.com/security/cve/CVE-2019-13751
  https://access.redhat.com/security/cve/CVE-2019-17594
  https://access.redhat.com/security/cve/CVE-2019-17595
  https://access.redhat.com/security/cve/CVE-2019-18218
  https://access.redhat.com/security/cve/CVE-2019-19603
  https://access.redhat.com/security/cve/CVE-2019-20838
  https://access.redhat.com/security/cve/CVE-2020-12762
  https://access.redhat.com/security/cve/CVE-2020-13435
  https://access.redhat.com/security/cve/CVE-2020-14155
  https://access.redhat.com/security/cve/CVE-2020-16135
  https://access.redhat.com/security/cve/CVE-2020-24370
  https://access.redhat.com/security/cve/CVE-2020-25709
  https://access.redhat.com/security/cve/CVE-2020-25710
  https://access.redhat.com/security/cve/CVE-2021-0920
  https://access.redhat.com/security/cve/CVE-2021-3200
  https://access.redhat.com/security/cve/CVE-2021-3426
  https://access.redhat.com/security/cve/CVE-2021-3445
  https://access.redhat.com/security/cve/CVE-2021-3521
  https://access.redhat.com/security/cve/CVE-2021-3572
  https://access.redhat.com/security/cve/CVE-2021-3580
  https://access.redhat.com/security/cve/CVE-2021-3800
  https://access.redhat.com/security/cve/CVE-2021-3999
  https://access.redhat.com/security/cve/CVE-2021-4122
  https://access.redhat.com/security/cve/CVE-2021-4154
  https://access.redhat.com/security/cve/CVE-2021-20231
  https://access.redhat.com/security/cve/CVE-2021-20232
  https://access.redhat.com/security/cve/CVE-2021-21684
  https://access.redhat.com/security/cve/CVE-2021-22876
  https://access.redhat.com/security/cve/CVE-2021-22898
  https://access.redhat.com/security/cve/CVE-2021-22925
  https://access.redhat.com/security/cve/CVE-2021-23177
  https://access.redhat.com/security/cve/CVE-2021-28153
  https://access.redhat.com/security/cve/CVE-2021-31566
  https://access.redhat.com/security/cve/CVE-2021-33560
  https://access.redhat.com/security/cve/CVE-2021-36084
  https://access.redhat.com/security/cve/CVE-2021-36085
  https://access.redhat.com/security/cve/CVE-2021-36086
  https://access.redhat.com/security/cve/CVE-2021-36087
  https://access.redhat.com/security/cve/CVE-2021-36221
  https://access.redhat.com/security/cve/CVE-2021-41190
  https://access.redhat.com/security/cve/CVE-2021-42574
  https://access.redhat.com/security/cve/CVE-2021-44716
  https://access.redhat.com/security/cve/CVE-2021-44717
  https://access.redhat.com/security/cve/CVE-2021-45960
  https://access.redhat.com/security/cve/CVE-2021-46143
  https://access.redhat.com/security/cve/CVE-2022-0261
  https://access.redhat.com/security/cve/CVE-2022-0318
  https://access.redhat.com/security/cve/CVE-2022-0330
  https://access.redhat.com/security/cve/CVE-2022-0359
  https://access.redhat.com/security/cve/CVE-2022-0361
  https://access.redhat.com/security/cve/CVE-2022-0392
  https://access.redhat.com/security/cve/CVE-2022-0413
  https://access.redhat.com/security/cve/CVE-2022-0435
  https://access.redhat.com/security/cve/CVE-2022-0492
  https://access.redhat.com/security/cve/CVE-2022-0516
  https://access.redhat.com/security/cve/CVE-2022-0532
  https://access.redhat.com/security/cve/CVE-2022-0778
  https://access.redhat.com/security/cve/CVE-2022-0847
  https://access.redhat.com/security/cve/CVE-2022-22816
  https://access.redhat.com/security/cve/CVE-2022-22817
  https://access.redhat.com/security/cve/CVE-2022-22822
  https://access.redhat.com/security/cve/CVE-2022-22823
  https://access.redhat.com/security/cve/CVE-2022-22824
  https://access.redhat.com/security/cve/CVE-2022-22825
  https://access.redhat.com/security/cve/CVE-2022-22826
  https://access.redhat.com/security/cve/CVE-2022-22827
  https://access.redhat.com/security/cve/CVE-2022-22942
  https://access.redhat.com/security/cve/CVE-2022-23218
  https://access.redhat.com/security/cve/CVE-2022-23219
  https://access.redhat.com/security/cve/CVE-2022-23308
  https://access.redhat.com/security/cve/CVE-2022-23852
  https://access.redhat.com/security/cve/CVE-2022-24407
  https://access.redhat.com/security/cve/CVE-2022-25235
  https://access.redhat.com/security/cve/CVE-2022-25236
  https://access.redhat.com/security/cve/CVE-2022-25315
  https://access.redhat.com/security/updates/classification/#moderate

6. Contact:

The Red Hat security contact is . More contact
details at   https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.