RHSA-2021:2977: Moderate: OpenShift Container Platform 4.7.23 security update
Red Hat OpenShift Container Platform is Red Hat's cloud computingKubernetes application platform solution designed for on-premise or privatecloud deployments.Security Fix(es): gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.You may download the oc tool and use it to inspect release image metadataas follows:(For x8664 architecture)$ oc adm release infoquay.io/openshift-release-dev/ocp-release:4.7.23-x8664The image digest issha256:fb00f5e16a2092c3f15113ad8de0d2e841abdb43c9c39794522fc79784a3efb0(For s390x architecture)$ oc adm release infoquay.io/openshift-release-dev/ocp-release:4.7.23-s390xThe image digest issha256:5e633adb1d47cd2c0a000caa02d937074cab4e3b601b99d71368604c3109c632(For ppc64le architecture)$ oc adm release infoquay.io/openshift-release-dev/ocp-release:4.7.23-ppc64leThe image digest issha256:7adfc7d4513763ac62700f3d5eb7fd9050b925de8e9ccc5b2bb6dee593522c5aAll OpenShift Container Platform 4.7 users are advised to upgrade to theseupdated packages and images when they are available in the appropriaterelease channel. To check for available updates, use the OpenShift Consoleor the CLI oc command. Instructions for upgrading a cluster are availableathttps://docs.openshift.com/container-platform/4.7/updating/updating-cluster between-minor.html#understanding-upgrade-channelsupdating-cluster-between minor
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2021:2977?
The severity of RHSA-2021:2977 has been rated as critical due to the lack of index validation in the gogo/protobuf plugin.
How do I fix RHSA-2021:2977?
To fix RHSA-2021:2977, you should update your Red Hat OpenShift Container Platform to the latest version that addresses this vulnerability.
What software is affected by RHSA-2021:2977?
RHSA-2021:2977 affects Red Hat OpenShift Container Platform deployments.
What vulnerability does RHSA-2021:2977 address?
RHSA-2021:2977 addresses the vulnerability CVE-2021-3177 related to gogo/protobuf index validation.
Is there any workaround for RHSA-2021:2977?
There are no documented workarounds for RHSA-2021:2977; the recommended action is to apply the available updates.