An OpenShift Virtualization 4.13.0 RPMs security and bug fix update has been released.

RHSA-2023:3204-01: Moderate: OpenShift Virtualization 4.13.0 RPMs security and bug fix update

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: OpenShift Virtualization 4.13.0 RPMs security and bug fix update
Advisory ID: RHSA-2023:3204-01
Product: OpenShift Virtualization
Advisory URL:   https://access.redhat.com/errata/RHSA-2023:3204
Issue date: 2023-05-18
CVE Names: CVE-2022-27664 CVE-2022-32149 CVE-2022-32189
CVE-2022-32190 CVE-2022-41717
=====================================================================

1. Summary:

Red Hat OpenShift Virtualization release 4.13.0 is now available with
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

CNV 4.13 for RHEL 7 - x86_64
CNV 4.13 for RHEL 8 - aarch64, x86_64
CNV 4.13 for RHEL 9 - aarch64, x86_64

3. Description:

OpenShift Virtualization is Red Hat's virtualization solution designed for
Red Hat OpenShift Container Platform.

This advisory contains OpenShift Virtualization 4.13.0 RPMs.

Security Fix(es):

* golang: net/http: handle server errors after sending GOAWAY
(CVE-2022-27664)

* golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time
to parse complex tags (CVE-2022-32149)

* golang: net/url: JoinPath does not strip relative path components in all
circumstances (CVE-2022-32190)

* golang: net/http: excessive memory growth in a Go server accepting HTTP/2
requests (CVE-2022-41717)

* golang: math/big: decoding big.Float and big.Rat types can panic if the
encoded message is too short, potentially allowing a denial of service
(CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* 4.13.0 rpms (BZ#2124993)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

  https://access.redhat.com/articles/11258

5. Bugs fixed (  https://bugzilla.redhat.com/):

2113814 - CVE-2022-32189 golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service
2124668 - CVE-2022-32190 golang: net/url: JoinPath does not strip relative path components in all circumstances
2124669 - CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
2124993 - 4.13.0 rpms
2134010 - CVE-2022-32149 golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags
2161274 - CVE-2022-41717 golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests

6. Package List:

CNV 4.13 for RHEL 7:

Source:
kubevirt-4.13.0-1469.el7.src.rpm

x86_64:
kubevirt-virtctl-4.13.0-1469.el7.x86_64.rpm
kubevirt-virtctl-redistributable-4.13.0-1469.el7.x86_64.rpm

CNV 4.13 for RHEL 8:

Source:
kubevirt-4.13.0-1469.el8.src.rpm

aarch64:
kubevirt-virtctl-4.13.0-1469.el8.aarch64.rpm
kubevirt-virtctl-redistributable-4.13.0-1469.el8.aarch64.rpm

x86_64:
kubevirt-virtctl-4.13.0-1469.el8.x86_64.rpm
kubevirt-virtctl-redistributable-4.13.0-1469.el8.x86_64.rpm

CNV 4.13 for RHEL 9:

Source:
kubevirt-4.13.0-1469.el9.src.rpm

aarch64:
kubevirt-virtctl-4.13.0-1469.el9.aarch64.rpm
kubevirt-virtctl-redistributable-4.13.0-1469.el9.aarch64.rpm

x86_64:
kubevirt-virtctl-4.13.0-1469.el9.x86_64.rpm
kubevirt-virtctl-redistributable-4.13.0-1469.el9.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
  https://access.redhat.com/security/team/key/

7. References:

  https://access.redhat.com/security/cve/CVE-2022-27664
  https://access.redhat.com/security/cve/CVE-2022-32149
  https://access.redhat.com/security/cve/CVE-2022-32189
  https://access.redhat.com/security/cve/CVE-2022-32190
  https://access.redhat.com/security/cve/CVE-2022-41717
  https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is . More contact
details at   https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.