A Multicluster Engine for Kubernetes 2.0 hotfix security update for console has been released.
RHSA-2023:1893-01: Critical: Multicluster Engine for Kubernetes 2.0 hotfix security update for console
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: Multicluster Engine for Kubernetes 2.0 hotfix security update for console
Advisory ID: RHSA-2023:1893-01
Product: multicluster engine for Kubernetes
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1893
Issue date: 2023-04-20
CVE Names: CVE-2022-4304 CVE-2022-4415 CVE-2022-4450
CVE-2023-0215 CVE-2023-0286 CVE-2023-23916
CVE-2023-29017 CVE-2023-29199 CVE-2023-30547
=====================================================================
1. Summary:
Red Hat Multicluster Engine Hotfix Security Update for Console
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Description:
Security Fix(es)
* CVE-2023-29017 vm2: Sandbox Escape
* CVE-2023-29199 vm2: Sandbox Escape
* CVE-2023-30547 vm2: Sandbox Escape when exception sanitization
3. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied, and that you are running
Multicluster Engine for Kubernetes version 2.0.7.
See https://access.redhat.com/solutions/7007647 for instructions on how to
apply this hotfix, as well as for information about when the hotfix has
been
superseded by a permanent fix and should be removed.
Important: This hotfix is a temporary fix that will be supported until 30
days after the date when the next patch release of the product is released.
After the 30-day period ends, you must either update to the latest patch
release and remove this hotfix to continue receiving security updates and
maintain support or upgrade to a newer feature release of the product.
4. Bugs fixed ( https://bugzilla.redhat.com/):
2185374 - CVE-2023-29017 vm2: sandbox escape
2187409 - CVE-2023-29199 vm2: Sandbox Escape
2187608 - CVE-2023-30547 vm2: Sandbox Escape when exception sanitization
5. References:
https://access.redhat.com/security/cve/CVE-2022-4304
https://access.redhat.com/security/cve/CVE-2022-4415
https://access.redhat.com/security/cve/CVE-2022-4450
https://access.redhat.com/security/cve/CVE-2023-0215
https://access.redhat.com/security/cve/CVE-2023-0286
https://access.redhat.com/security/cve/CVE-2023-23916
https://access.redhat.com/security/cve/CVE-2023-29017
https://access.redhat.com/security/cve/CVE-2023-29199
https://access.redhat.com/security/cve/CVE-2023-30547
https://access.redhat.com/security/updates/classification/#critical
6. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
