An OpenShift Virtualization 4.10.2 Images security and bug fix update has been released.

RHSA-2022:5026-01: Moderate: OpenShift Virtualization 4.10.2 Images security and bug fix update

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: OpenShift Virtualization 4.10.2 Images security and bug fix update
Advisory ID: RHSA-2022:5026-01
Product: cnv
Advisory URL:   https://access.redhat.com/errata/RHSA-2022:5026
Issue date: 2022-06-14
CVE Names: CVE-2018-25032 CVE-2022-1271 CVE-2022-21698
=====================================================================

1. Summary:

Red Hat OpenShift Virtualization release 4.10.2 is now available with
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

This advisory contains the following OpenShift Virtualization 4.10.2
images:

RHEL-8-CNV-4.10
===============

virt-artifacts-server-container-v4.10.2-1
kubevirt-template-validator-container-v4.10.2-1
virtio-win-container-v4.10.2-1
node-maintenance-operator-container-v4.10.2-1
hostpath-provisioner-operator-container-v4.10.2-1
virt-handler-container-v4.10.2-1
libguestfs-tools-container-v4.10.2-1
hostpath-csi-driver-container-v4.10.2-1
virt-operator-container-v4.10.2-1
virt-launcher-container-v4.10.2-1
hostpath-provisioner-container-v4.10.2-1
virt-api-container-v4.10.2-1
virt-controller-container-v4.10.2-1
cnv-must-gather-container-v4.10.2-2
kubernetes-nmstate-handler-container-v4.10.2-3
bridge-marker-container-v4.10.2-3
virt-cdi-uploadproxy-container-v4.10.2-3
virt-cdi-uploadserver-container-v4.10.2-3
ovs-cni-marker-container-v4.10.2-3
virt-cdi-operator-container-v4.10.2-3
ovs-cni-plugin-container-v4.10.2-3
kubemacpool-container-v4.10.2-3
virt-cdi-controller-container-v4.10.2-3
kubevirt-ssp-operator-container-v4.10.2-4
cnv-containernetworking-plugins-container-v4.10.2-3
cluster-network-addons-operator-container-v4.10.2-3
virt-cdi-apiserver-container-v4.10.2-3
hyperconverged-cluster-operator-container-v4.10.2-2
hyperconverged-cluster-webhook-container-v4.10.2-2
virt-cdi-cloner-container-v4.10.2-3
virt-cdi-importer-container-v4.10.2-3
hco-bundle-registry-container-v4.10.2-10

Security Fix(es):

* prometheus/client_golang: Denial of service using
InstrumentHandlerCounter (CVE-2022-21698)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

  https://access.redhat.com/articles/11258

4. Bugs fixed (  https://bugzilla.redhat.com/):

2016290 - [Warm] Warm Migration Fails and reporting ambiguous status.
2033346 - [cnv-4.10] Add vm name label to virt-launcher pods
2037605 - Openshift Virtualization alert 50% of the hyperconverged-cluster-operator-metrics/hyperconverged-cluster-operator-metrics targets in openshift-cnv namespace have been unreachable for more than 15 minutes on port 8686
2045880 - CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter
2074384 - SAP HANA template - template should be moved to   https://github.com/RHsyseng/cnv-supplemental-templates
2080453 - [4.10.z] cluster-network-addons-operator deployment's MULTUS_IMAGE is pointing to brew image
2080918 - Upgrade CNV from 4.10.1 to 4.11 should be blocked if CNV k8s-nmstate is still installed
2083594 - virtctl guestfs incorrectly assumes image name
2085459 - smartclone-controller not started and cloned DataVolumes stuck in SnapshotForSmartCloneInProgress
2086114 - HCO is taking more than 12 minutes to reconcile consolequickstart connect-ext-net-to-vm and customize-a-boot-source
2086541 - NMO CSV dependency to CNV is failing
2088476 - [4.10.z] VMSnapshot restore fails to provision volume with size mismatch error
2088622 - 4.10.2 containers
2089637 - CNAO is blocking upgrade to 4.11 despite standalone nmstate operator is installed
2089658 - SSP Reconcile logging improvement when CR resources are changed
2089661 - [CNV-4.10] HCO Being Unable to Reconcile State

5. References:

  https://access.redhat.com/security/cve/CVE-2018-25032
  https://access.redhat.com/security/cve/CVE-2022-1271
  https://access.redhat.com/security/cve/CVE-2022-21698
  https://access.redhat.com/security/updates/classification/#moderate

6. Contact:

The Red Hat security contact is . More contact
details at   https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.