[RHSA-2023:4003-01] Moderate: Red Hat Service Interconnect 1.4 Release security update
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat Service Interconnect 1.4 Release security update
Advisory ID: RHSA-2023:4003-01
Product: Red Hat Service Interconnect
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4003
Issue date: 2023-07-10
CVE Names: CVE-2022-2879 CVE-2022-2880 CVE-2022-28327
CVE-2022-41715 CVE-2022-41723 CVE-2022-41724
CVE-2022-41725 CVE-2023-24534 CVE-2023-24536
CVE-2023-24537 CVE-2023-24538 CVE-2023-24539
CVE-2023-29400
=====================================================================
1. Summary:
This is release 1.4 of the rpms for Red Hat Service Interconnect. Red Hat
Service Interconnect 1.4 introduces a service network, linking TCP and HTTP
services across the hybrid cloud.
A service network enables communication between services running in
different network locations or sites. It allows geographically distributed
services to connect as if they were all running in the same site.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
8Base-Service-Interconnect-1 - noarch, x86_64
9Base-Service-Interconnect-1 - noarch, x86_64
3. Description:
As a Kubernetes user, I cannot connect easily connect services from one
cluster with services on another cluster. Red Hat Application Interconnect
enables me to create a service network and it allows geographically
distributed services to connect as if they were all running in the same
site.
Security Fix(es):
* golang: archive/tar: unbounded memory consumption when reading headers
(CVE-2022-2879)
* golang: net/http/httputil: ReverseProxy should not forward unparseable
query parameters (CVE-2022-2880)
* golang: crypto/elliptic: panic caused by oversized scalar
(CVE-2022-28327)
* golang: regexp/syntax: limit memory used by parsing regexps
(CVE-2022-41715)
* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK
decoding (CVE-2022-41723)
* golang: crypto/tls: large handshake records may cause panics
(CVE-2022-41724)
* golang: net/http, mime/multipart: denial of service from excessive
resource consumption (CVE-2022-41725)
* golang: net/http, net/textproto: denial of service from excessive memory
allocation (CVE-2023-24534)
* golang: net/http, net/textproto, mime/multipart: denial of service from
excessive resource consumption (CVE-2023-24536)
* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
* golang: html/template: backticks not treated as string delimiters
(CVE-2023-24538)
* golang: html/template: improper sanitization of CSS values
(CVE-2023-24539)
* golang: html/template: improper handling of empty HTML attributes
(CVE-2023-29400)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed ( https://bugzilla.redhat.com/):
2077689 - CVE-2022-28327 golang: crypto/elliptic: panic caused by oversized scalar
2132867 - CVE-2022-2879 golang: archive/tar: unbounded memory consumption when reading headers
2132868 - CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
2132872 - CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding
2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption
2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics
2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters
2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation
2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing
2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values
2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes
6. Package List:
8Base-Service-Interconnect-1:
Source:
libwebsockets-4.3.1-1.el8ai.src.rpm
qpid-proton-0.37.0-2.el8ai.src.rpm
skupper-cli-1.4.1-2.el8.src.rpm
skupper-router-2.4.1-2.el8.src.rpm
noarch:
skupper-router-common-2.4.1-2.el8.noarch.rpm
skupper-router-docs-2.4.1-2.el8.noarch.rpm
skupper-router-tools-2.4.1-2.el8.noarch.rpm
x86_64:
libwebsockets-4.3.1-1.el8ai.x86_64.rpm
libwebsockets-debuginfo-4.3.1-1.el8ai.x86_64.rpm
libwebsockets-debugsource-4.3.1-1.el8ai.x86_64.rpm
libwebsockets-devel-4.3.1-1.el8ai.x86_64.rpm
python3-qpid-proton-0.37.0-2.el8ai.x86_64.rpm
python3-qpid-proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-c-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-c-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-c-devel-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-cpp-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-debugsource-0.37.0-2.el8ai.x86_64.rpm
rubygem-qpid_proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm
skupper-cli-1.4.1-2.el8.x86_64.rpm
skupper-router-2.4.1-2.el8.x86_64.rpm
skupper-router-debuginfo-2.4.1-2.el8.x86_64.rpm
skupper-router-debugsource-2.4.1-2.el8.x86_64.rpm
9Base-Service-Interconnect-1:
Source:
jsoncpp-1.9.4-3.el9.src.rpm
libwebsockets-4.3.1-1.el9ai.src.rpm
qpid-proton-0.37.0-2.el9ai.src.rpm
skupper-cli-1.4.1-2.el9.src.rpm
skupper-router-2.4.1-2.el9.src.rpm
noarch:
skupper-router-common-2.4.1-2.el9.noarch.rpm
skupper-router-docs-2.4.1-2.el9.noarch.rpm
skupper-router-tools-2.4.1-2.el9.noarch.rpm
x86_64:
jsoncpp-1.9.4-3.el9.x86_64.rpm
jsoncpp-debuginfo-1.9.4-3.el9.x86_64.rpm
jsoncpp-debugsource-1.9.4-3.el9.x86_64.rpm
jsoncpp-devel-1.9.4-3.el9.x86_64.rpm
libwebsockets-4.3.1-1.el9ai.x86_64.rpm
libwebsockets-debuginfo-4.3.1-1.el9ai.x86_64.rpm
libwebsockets-debugsource-4.3.1-1.el9ai.x86_64.rpm
libwebsockets-devel-4.3.1-1.el9ai.x86_64.rpm
python3-qpid-proton-0.37.0-2.el9ai.x86_64.rpm
python3-qpid-proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-c-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-c-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-c-devel-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-cpp-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-cpp-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-cpp-devel-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-debugsource-0.37.0-2.el9ai.x86_64.rpm
rubygem-qpid_proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm
skupper-cli-1.4.1-2.el9.x86_64.rpm
skupper-router-2.4.1-2.el9.x86_64.rpm
skupper-router-debuginfo-2.4.1-2.el9.x86_64.rpm
skupper-router-debugsource-2.4.1-2.el9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2022-2879
https://access.redhat.com/security/cve/CVE-2022-2880
https://access.redhat.com/security/cve/CVE-2022-28327
https://access.redhat.com/security/cve/CVE-2022-41715
https://access.redhat.com/security/cve/CVE-2022-41723
https://access.redhat.com/security/cve/CVE-2022-41724
https://access.redhat.com/security/cve/CVE-2022-41725
https://access.redhat.com/security/cve/CVE-2023-24534
https://access.redhat.com/security/cve/CVE-2023-24536
https://access.redhat.com/security/cve/CVE-2023-24537
https://access.redhat.com/security/cve/CVE-2023-24538
https://access.redhat.com/security/cve/CVE-2023-24539
https://access.redhat.com/security/cve/CVE-2023-29400
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_service_interconnect
8. Contact:
The Red Hat security contact is [secalert@redhat.com]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
--
A Red Hat Service Interconnect 1.4 security update has been released.
