ID

VAR-202104-0334

CVE

CVE-2021-22876

TITLE

Haxx libcurl Information disclosure vulnerability

DESCRIPTION

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request. This could lead to exposure of the credentials to the server to which requests were redirected. (CVE-2021-22876) A vulnerability was found in curl where a flaw in the option parser for sending NEW_ENV variables libcurl can pass uninitialized data from a stack-based buffer to the server. This issue leads to potentially revealing sensitive internal information to the server using a clear-text network protocol. The highest threat from this vulnerability is to confidentiality. (CVE-2021-22898). Bugs fixed (https://bugzilla.redhat.com/): 1944888 - CVE-2021-21409 netty: Request smuggling via content-length header 2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data 2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way 2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value 5. JIRA issues fixed (https://issues.jboss.org/): LOG-1897 - Applying cluster state is causing elasticsearch to hit an issue and become unusable LOG-1925 - [release-5.3] No datapoint for CPU on openshift-logging dashboard LOG-1962 - [release-5.3] CLO panic: runtime error: slice bounds out of range [:-1] 6. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Bugs fixed (https://bugzilla.redhat.com/): 1941964 - CVE-2021-22876 curl: Leak of authentication credentials in URL via automatic Referer 1947493 - Why there is a difference between curl --head output on the RHEL7 and RHEL8. 1964887 - CVE-2021-22898 curl: TELNET stack contents disclosure 1970902 - CVE-2021-22925 curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure 6. Summary: The Migration Toolkit for Containers (MTC) 1.6.3 is now available. Description: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Bugs fixed (https://bugzilla.redhat.com/): 2019088 - "MigrationController" CR displays syntax error when unquiescing applications 2021666 - Route name longer than 63 characters causes direct volume migration to fail 2021668 - "MigrationController" CR ignores the "cluster_subdomain" value for direct volume migration routes 2022017 - CVE-2021-3948 mig-controller: incorrect namespaces handling may lead to not authorized usage of Migration Toolkit for Containers (MTC) 2024966 - Manifests not used by Operator Lifecycle Manager must be removed from the MTC 1.6 Operator image 2027196 - "migration-controller" pod goes into "CrashLoopBackoff" state if an invalid registry route is entered on the "Clusters" page of the web console 2027382 - "Copy oc describe/oc logs" window does not close automatically after timeout 2028841 - "rsync-client" container fails during direct volume migration with "Address family not supported by protocol" error 2031793 - "migration-controller" pod goes into "CrashLoopBackOff" state if "MigPlan" CR contains an invalid "includedResources" resource 2039852 - "migration-controller" pod goes into "CrashLoopBackOff" state if "MigPlan" CR contains an invalid "destMigClusterRef" or "srcMigClusterRef" 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP8 security update Advisory ID: RHSA-2021:2472-01 Product: Red Hat JBoss Core Services Advisory URL: https://access.redhat.com/errata/RHSA-2021:2472 Issue date: 2021-06-17 CVE Names: CVE-2020-8169 CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 CVE-2021-22876 CVE-2021-22890 CVE-2021-22901 CVE-2021-31618 ===================================================================== 1. Summary: Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss Core Services on RHEL 7 Server - noarch, ppc64, x86_64 Red Hat JBoss Core Services on RHEL 8 - noarch, x86_64 3. Description: This release adds the new Apache HTTP Server 2.4.37 Service Pack 8 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 7 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es): * curl: Use-after-free in TLS session handling when using OpenSSL TLS backend (CVE-2021-22901) * httpd: NULL pointer dereference on specially crafted HTTP/2 request (CVE-2021-31618) * libcurl: partial password leak over DNS on HTTP redirect (CVE-2020-8169) * curl: FTP PASV command response can cause curl to connect to arbitrary host (CVE-2020-8284) * curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used (CVE-2020-8285) * curl: Inferior OCSP verification (CVE-2020-8286) * curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876) * curl: TLS 1.3 session ticket mix-up with HTTPS proxy host (CVE-2021-22890) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. Applications using the APR libraries, such as httpd, must be restarted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1847916 - CVE-2020-8169 libcurl: partial password leak over DNS on HTTP redirect 1902667 - CVE-2020-8284 curl: FTP PASV command response can cause curl to connect to arbitrary host 1902687 - CVE-2020-8285 curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used 1906096 - CVE-2020-8286 curl: Inferior OCSP verification 1941964 - CVE-2021-22876 curl: Leak of authentication credentials in URL via automatic Referer 1941965 - CVE-2021-22890 curl: TLS 1.3 session ticket mix-up with HTTPS proxy host 1963146 - CVE-2021-22901 curl: Use-after-free in TLS session handling when using OpenSSL TLS backend 1968013 - CVE-2021-31618 httpd: NULL pointer dereference on specially crafted HTTP/2 request 6. Package List: Red Hat JBoss Core Services on RHEL 7 Server: Source: jbcs-httpd24-1-18.jbcs.el7.src.rpm jbcs-httpd24-apr-1.6.3-105.jbcs.el7.src.rpm jbcs-httpd24-apr-util-1.6.1-82.jbcs.el7.src.rpm jbcs-httpd24-curl-7.77.0-2.jbcs.el7.src.rpm jbcs-httpd24-httpd-2.4.37-74.jbcs.el7.src.rpm jbcs-httpd24-jansson-2.11-55.jbcs.el7.src.rpm jbcs-httpd24-mod_cluster-native-1.3.16-5.Final_redhat_2.jbcs.el7.src.rpm jbcs-httpd24-mod_http2-1.15.7-17.jbcs.el7.src.rpm jbcs-httpd24-mod_jk-1.2.48-16.redhat_1.jbcs.el7.src.rpm jbcs-httpd24-mod_md-2.0.8-36.jbcs.el7.src.rpm jbcs-httpd24-mod_security-2.9.2-63.GA.jbcs.el7.src.rpm noarch: jbcs-httpd24-httpd-manual-2.4.37-74.jbcs.el7.noarch.rpm ppc64: jbcs-httpd24-1-18.jbcs.el7.ppc64.rpm jbcs-httpd24-curl-7.77.0-2.jbcs.el7.ppc64.rpm jbcs-httpd24-curl-debuginfo-7.77.0-2.jbcs.el7.ppc64.rpm jbcs-httpd24-jansson-2.11-55.jbcs.el7.ppc64.rpm jbcs-httpd24-jansson-debuginfo-2.11-55.jbcs.el7.ppc64.rpm jbcs-httpd24-jansson-devel-2.11-55.jbcs.el7.ppc64.rpm jbcs-httpd24-libcurl-7.77.0-2.jbcs.el7.ppc64.rpm jbcs-httpd24-libcurl-devel-7.77.0-2.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_http2-1.15.7-17.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_http2-debuginfo-1.15.7-17.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_md-2.0.8-36.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_md-debuginfo-2.0.8-36.jbcs.el7.ppc64.rpm jbcs-httpd24-runtime-1-18.jbcs.el7.ppc64.rpm x86_64: jbcs-httpd24-1-18.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-1.6.3-105.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-debuginfo-1.6.3-105.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-devel-1.6.3-105.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-debuginfo-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-devel-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-ldap-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-mysql-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-nss-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-odbc-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-openssl-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-pgsql-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-sqlite-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-curl-7.77.0-2.jbcs.el7.x86_64.rpm jbcs-httpd24-curl-debuginfo-7.77.0-2.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-debuginfo-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-devel-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-selinux-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-tools-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-jansson-2.11-55.jbcs.el7.x86_64.rpm jbcs-httpd24-jansson-debuginfo-2.11-55.jbcs.el7.x86_64.rpm jbcs-httpd24-jansson-devel-2.11-55.jbcs.el7.x86_64.rpm jbcs-httpd24-libcurl-7.77.0-2.jbcs.el7.x86_64.rpm jbcs-httpd24-libcurl-devel-7.77.0-2.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_cluster-native-1.3.16-5.Final_redhat_2.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_cluster-native-debuginfo-1.3.16-5.Final_redhat_2.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_http2-1.15.7-17.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_http2-debuginfo-1.15.7-17.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_jk-ap24-1.2.48-16.redhat_1.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_jk-debuginfo-1.2.48-16.redhat_1.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_jk-manual-1.2.48-16.redhat_1.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_ldap-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_md-2.0.8-36.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_md-debuginfo-2.0.8-36.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_proxy_html-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_security-2.9.2-63.GA.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_security-debuginfo-2.9.2-63.GA.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_session-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_ssl-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-runtime-1-18.jbcs.el7.x86_64.rpm Red Hat JBoss Core Services on RHEL 8: Source: jbcs-httpd24-1-18.el8jbcs.src.rpm jbcs-httpd24-apr-1.6.3-105.el8jbcs.src.rpm jbcs-httpd24-apr-util-1.6.1-82.el8jbcs.src.rpm jbcs-httpd24-brotli-1.0.6-40.el8jbcs.src.rpm jbcs-httpd24-curl-7.77.0-2.el8jbcs.src.rpm jbcs-httpd24-httpd-2.4.37-74.el8jbcs.src.rpm jbcs-httpd24-jansson-2.11-55.el8jbcs.src.rpm jbcs-httpd24-mod_cluster-native-1.3.16-5.Final_redhat_2.el8jbcs.src.rpm jbcs-httpd24-mod_http2-1.15.7-17.el8jbcs.src.rpm jbcs-httpd24-mod_jk-1.2.48-16.redhat_1.el8jbcs.src.rpm jbcs-httpd24-mod_md-2.0.8-36.el8jbcs.src.rpm jbcs-httpd24-mod_security-2.9.2-63.GA.el8jbcs.src.rpm jbcs-httpd24-nghttp2-1.39.2-37.el8jbcs.src.rpm jbcs-httpd24-openssl-1.1.1g-6.el8jbcs.src.rpm jbcs-httpd24-openssl-chil-1.0.0-5.el8jbcs.src.rpm jbcs-httpd24-openssl-pkcs11-0.4.10-20.el8jbcs.src.rpm noarch: jbcs-httpd24-httpd-manual-2.4.37-74.el8jbcs.noarch.rpm x86_64: jbcs-httpd24-1-18.el8jbcs.x86_64.rpm jbcs-httpd24-apr-1.6.3-105.el8jbcs.x86_64.rpm jbcs-httpd24-apr-debuginfo-1.6.3-105.el8jbcs.x86_64.rpm jbcs-httpd24-apr-devel-1.6.3-105.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-devel-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-ldap-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-ldap-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-mysql-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-mysql-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-nss-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-nss-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-odbc-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-odbc-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-openssl-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-openssl-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-pgsql-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-pgsql-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-sqlite-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-sqlite-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-brotli-1.0.6-40.el8jbcs.x86_64.rpm jbcs-httpd24-brotli-debuginfo-1.0.6-40.el8jbcs.x86_64.rpm jbcs-httpd24-brotli-devel-1.0.6-40.el8jbcs.x86_64.rpm jbcs-httpd24-curl-7.77.0-2.el8jbcs.x86_64.rpm jbcs-httpd24-curl-debuginfo-7.77.0-2.el8jbcs.x86_64.rpm jbcs-httpd24-httpd-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-httpd-debuginfo-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-httpd-devel-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-httpd-selinux-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-httpd-tools-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-httpd-tools-debuginfo-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-jansson-2.11-55.el8jbcs.x86_64.rpm jbcs-httpd24-jansson-debuginfo-2.11-55.el8jbcs.x86_64.rpm jbcs-httpd24-jansson-devel-2.11-55.el8jbcs.x86_64.rpm jbcs-httpd24-libcurl-7.77.0-2.el8jbcs.x86_64.rpm jbcs-httpd24-libcurl-debuginfo-7.77.0-2.el8jbcs.x86_64.rpm jbcs-httpd24-libcurl-devel-7.77.0-2.el8jbcs.x86_64.rpm jbcs-httpd24-mod_cluster-native-1.3.16-5.Final_redhat_2.el8jbcs.x86_64.rpm jbcs-httpd24-mod_cluster-native-debuginfo-1.3.16-5.Final_redhat_2.el8jbcs.x86_64.rpm jbcs-httpd24-mod_http2-1.15.7-17.el8jbcs.x86_64.rpm jbcs-httpd24-mod_http2-debuginfo-1.15.7-17.el8jbcs.x86_64.rpm jbcs-httpd24-mod_jk-ap24-1.2.48-16.redhat_1.el8jbcs.x86_64.rpm jbcs-httpd24-mod_jk-ap24-debuginfo-1.2.48-16.redhat_1.el8jbcs.x86_64.rpm jbcs-httpd24-mod_jk-manual-1.2.48-16.redhat_1.el8jbcs.x86_64.rpm jbcs-httpd24-mod_ldap-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_ldap-debuginfo-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_md-2.0.8-36.el8jbcs.x86_64.rpm jbcs-httpd24-mod_md-debuginfo-2.0.8-36.el8jbcs.x86_64.rpm jbcs-httpd24-mod_proxy_html-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_proxy_html-debuginfo-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_security-2.9.2-63.GA.el8jbcs.x86_64.rpm jbcs-httpd24-mod_security-debuginfo-2.9.2-63.GA.el8jbcs.x86_64.rpm jbcs-httpd24-mod_session-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_session-debuginfo-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_ssl-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_ssl-debuginfo-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-nghttp2-1.39.2-37.el8jbcs.x86_64.rpm jbcs-httpd24-nghttp2-debuginfo-1.39.2-37.el8jbcs.x86_64.rpm jbcs-httpd24-nghttp2-devel-1.39.2-37.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-chil-1.0.0-5.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-chil-debuginfo-1.0.0-5.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-debuginfo-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-devel-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-libs-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-libs-debuginfo-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-perl-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-pkcs11-0.4.10-20.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-pkcs11-debuginfo-0.4.10-20.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-static-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-runtime-1-18.el8jbcs.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-8169 https://access.redhat.com/security/cve/CVE-2020-8284 https://access.redhat.com/security/cve/CVE-2020-8285 https://access.redhat.com/security/cve/CVE-2020-8286 https://access.redhat.com/security/cve/CVE-2021-22876 https://access.redhat.com/security/cve/CVE-2021-22890 https://access.redhat.com/security/cve/CVE-2021-22901 https://access.redhat.com/security/cve/CVE-2021-31618 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYMs2wNzjgjWX9erEAQiuqA//Wj88udaE82j3T1g70vO9Zf9s0Ym+xAWi SmIBQfiNIh9WRy9Jp6DqIxPtG7HQ+++VwXU2lx9LjXuicsQnmKRjdQtvYtqbCzbq uOrxFeLSK1AeI0ic9wo5a7JHxyzcg9yTxCIw8QtTzqpJjJHWTBK/xtiYp9V6A2xF NaXdlAyCRfje+0+EygZGBdX5UD6cr8vTLPtVmp2t+NfvyB7YQaHwSMi7ZzKvmN61 ZLj5++qEWde9k8zovupYAAe9suIwzaL4bdgbwdSyFYH/CDA1E9oyo22inzO4iaka ixwuhI8rnToaVLNyn7p/Ra585stBQ1GUE27dJBvlabYa35gdoVVy+e0mRsQ/pS3R vE48A9yOLhSaof8l2ZDQRuhr6KBFFEvdln7TcftIdQG7/iTVo0R03AxigGGn1bSv HQ911R6wcPAU300VfeIo5btkbJCPBHoovYCBJYBVlF5wjQ7RCWlr9VrX/wqMun68 8IrfPX8j4PIwUvxPygqIFUjg0xZHWiVN8H6tNeJKD8kHfv/4vCIOo9ZWxFI5VFV/ /2pqWtm5tnf3yfqFn8Z6OrkaQFR8q0jg0d2VLS4AmKC4joLTXvBZVKLEfLF+HGlO QnEYJ2EhDWHSU+ZViI/anzTRnN5tBxNxqsPn7rfTXLmxxwkUH9hgaCzVMG5MXYOZ lIrXPlR2tmY= =6HuS -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Description: Red Hat Advanced Cluster Management for Kubernetes 2.2.10 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console — with security policy built in. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.2/html/release_notes/ Security fixes: * CVE-2021-3795 semver-regex: inefficient regular expression complexity * CVE-2021-23440 nodejs-set-value: type confusion allows bypass of CVE-2019-10747 Related bugs: * RHACM 2.2.10 images (Bugzilla #2013652) 3. Bugs fixed (https://bugzilla.redhat.com/): 2004944 - CVE-2021-23440 nodejs-set-value: type confusion allows bypass of CVE-2019-10747 2006009 - CVE-2021-3795 semver-regex: inefficient regular expression complexity 2013652 - RHACM 2.2.10 images 5. Description: OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. Bugs fixed (https://bugzilla.redhat.com/): 1983596 - CVE-2021-34558 golang: crypto/tls: certificate of wrong type is causing TLS client to panic 1992006 - CVE-2021-29923 golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet 1997017 - unprivileged client fails to get guest agent data 1998855 - Node drain: Sometimes source virt-launcher pod status is Failed and not Completed 2000251 - RoleBinding and ClusterRoleBinding brought in by kubevirt does not get reconciled when kind is ServiceAccount 2001270 - [VMIO] [Warm from Vmware] Snapshot files are not deleted after Successful Import 2001281 - [VMIO] [Warm from VMware] Source VM should not be turned ON if vmio import is removed 2001901 - [4.8.3] NNCP creation failures after nmstate-handler pod deletion 2007336 - 4.8.3 containers 2007776 - Failed to Migrate Windows VM with CDROM (readonly) 2008511 - [CNV-4.8.3] VMI is in LiveMigrate loop when Upgrading Cluster from 2.6.7/4.7.32 to OCP 4.8.13 2012890 - With descheduler during multiple VMIs migrations, some VMs are restarted 2025475 - [4.8.3] Upgrade from 2.6 to 4.x versions failed due to vlan-filtering issues 2026881 - [4.8.3] vlan-filtering is getting applied on veth ports 5

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

information disclosure

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2026-02-01T20:48:26.971000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE