-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat OpenShift support for Windows Containers 6.0.1[security update] Advisory ID: RHSA-2023:4488-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2023:4488 Issue date: 2023-08-07 CVE Names: CVE-2020-24736 CVE-2022-27191 CVE-2022-30629 CVE-2022-35252 CVE-2022-36227 CVE-2022-43552 CVE-2023-0361 CVE-2023-1667 CVE-2023-2283 CVE-2023-25173 CVE-2023-26604 CVE-2023-27535 ==================================================================== 1. Summary: The components for Red Hat OpenShift support for Windows Containers 6.0.1 are now available. This product release includes bug fixes and security update for the following packages: windows-machine-config-operator and windows-machine-config-operator-bundle. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat OpenShift support for Windows Containers allows you to deploy Windows container workloads running on Windows Server containers. Security Fix(es): * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191) * containerd: supplementary groups are not set up properly (CVE-2023-25173) * golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4. Bugs fixed (https://bugzilla.redhat.com/): 2064702 - CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server 2092793 - CVE-2022-30629 golang: crypto/tls: session tickets lack random ticket_age_add 2174485 - CVE-2023-25173 containerd: Supplementary groups are not set up properly 5. JIRA issues fixed (https://issues.redhat.com/): OCPBUGS-10418 - Case sensitivity issue when label "openshift.io/cluster-monitoring" set to 'True' on openshift-windows-machine-config-operator namespace OCPBUGS-11831 - oc adm node-logs failing in vSphere CI OCPBUGS-15435 - Instance configurations fails on Windows Server 2019 without the container feature OCPBUGS-3572 - Check if Windows defender is running doesnt work OCPBUGS-4247 - Load balancer shows connectivity outage during Windows nodes upgrade OCPBUGS-5894 - Windows nodes do not get drained (deconfigure) during the upgrade process OCPBUGS-7726 - WMCO kubelet version not matching OCP payload's one OCPBUGS-8055 - containerd version is being misreported WINC-818 - Investigate if the Upgradeable condition is being tested in e2e suite WINC-823 - Test generated community manifests in WMCO e2e 6. References: https://access.redhat.com/security/cve/CVE-2020-24736 https://access.redhat.com/security/cve/CVE-2022-27191 https://access.redhat.com/security/cve/CVE-2022-30629 https://access.redhat.com/security/cve/CVE-2022-35252 https://access.redhat.com/security/cve/CVE-2022-36227 https://access.redhat.com/security/cve/CVE-2022-43552 https://access.redhat.com/security/cve/CVE-2023-0361 https://access.redhat.com/security/cve/CVE-2023-1667 https://access.redhat.com/security/cve/CVE-2023-2283 https://access.redhat.com/security/cve/CVE-2023-25173 https://access.redhat.com/security/cve/CVE-2023-26604 https://access.redhat.com/security/cve/CVE-2023-27535 https://access.redhat.com/security/updates/classification/#moderate 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJk0FTNAAoJENzjgjWX9erECFMQAJK2kwpbtRBzWge5z/BMC5Bh vXPuB0Ga9LEbL4y9WrrRATD31Mojhw4Il19Y4fMFo2yw3lRcb1Lleg0OCqCoUwgx RIQm7WYmmlRs+tIb8lJAqG03/ih7G71CY9tzIyEwNPcSengxrwUZEl0UCe2r52zX JAEZbuK5GVkWql2rqYSxvH8O7VCxPHfwSTxvpB23kbrocUILmIvCt17bRZ8XE1nW pbgY+VW4sBXWRCB2kgkwgP4GHJTnOve1Mgyxln1s8MTbVdUC9aNRG2pfZSV2v+42 VVwT1NX5OgWZTyvJfW878xYGTBoMLJlNGIlRzigwJWxcwwnHnpXbfSg41yE6PBPC 3IhateHGCGuwQOaUkUUYbNTt+LU4huyM/fvAx1rLJgs0ONTURgLZOJPpgDrNGvSp zqf6+iXvgO3CAAKaLCUY2pYchVyOaKPxPiTFLirbH8y2PGbmlEne15qw0i3f5ePC V3/evN4L/CMkru8fAw0pp4b8SkZVTxUPub5IgDIA/FGdMLb2VtZJhKFuIzoYdSoQ +FC//QoMaouUqMDK9AptuON//3H3Tkk76iIqRFPv6Ve8EHZzgMrY1kaL6A6+a3k1 Rt/Mr37y98JaonqYt40oIG4Fbtjf/6XIHUnWZMfcZwcTKuaoJfsvCjP5s2CS1d2R i9r21xzcEQd8TFmq5CQR =Rxx9 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce