RHSA-2021:3016: Important: Red Hat Advanced Cluster Management for Kubernetes version 2.3

First published: Thu Aug 05 2021(Updated: )

Red Hat Advanced Cluster Management for Kubernetes 2.3.0 images<br>Red Hat Advanced Cluster Management for Kubernetes provides the<br>capabilities to address common challenges that administrators and site<br>reliability engineers face as they work across a range of public and<br>private cloud environments. Clusters and applications are all visible and<br>managed from a single console—with security policy built in.<br>This advisory contains the container images for Red Hat Advanced Cluster<br>Management for Kubernetes, which fix several bugs and security issues. See<br>the following Release Notes documentation, which will be updated shortly<br>for this release, for additional details about this release:<br><a href="https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_mana" target="_blank">https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_mana</a> gement_for_kubernetes/2.3/html/release_notes/<br>Security:<br><li> fastify-reply-from: crafted URL allows prefix scape of the proxied backend service (CVE-2021-21321)</li> <li> fastify-http-proxy: crafted URL allows prefix scape of the proxied</li> backend service (CVE-2021-21322)<br><li> nodejs-netmask: improper input validation of octal input data (CVE-2021-28918)</li> <li> redis: Integer overflow via STRALGO LCS command (CVE-2021-29477)</li> <li> redis: Integer overflow via COPY command for large intsets (CVE-2021-29478)</li> <li> nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)</li> <li> nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions</li> (CVE-2020-28500)<br><li> golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)</li> <li> golang.org/x/text: Panic in language.ParseAcceptLanguage while processing</li> bcp47 tag (CVE-2020-28852)<br><li> nodejs-ansi_up: XSS due to insufficient URL sanitization (CVE-2021-3377)</li> <li> oras: zip-slip vulnerability via oras-pull (CVE-2021-21272)</li> <li> redis: integer overflow when configurable limit for maximum supported bulk input size is too big on 32-bit platforms (CVE-2021-21309)</li> <li> nodejs-lodash: command injection via template (CVE-2021-23337)</li> <li> nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)</li> <li> browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS) (CVE-2021-23364)</li> <li> nodejs-postcss: Regular expression denial of service during source map parsing (CVE-2021-23368)</li> <li> nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option (CVE-2021-23369)</li> <li> nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js (CVE-2021-23382)</li> <li> nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option (CVE-2021-23383)</li> <li> openssl: integer overflow in CipherUpdate (CVE-2021-23840)</li> <li> openssl: NULL pointer dereference in X509_issuer_and_serial_hash()</li> (CVE-2021-23841)<br><li> nodejs-ua-parser-js: ReDoS via malicious User-Agent header (CVE-2021-27292)</li> <li> grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call (CVE-2021-27358)</li> <li> nodejs-is-svg: ReDoS via malicious string (CVE-2021-28092)</li> <li> nodejs-netmask: incorrectly parses an IP address that has octal integer with invalid character (CVE-2021-29418)</li> <li> ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)</li> <li> normalize-url: ReDoS for data URLs (CVE-2021-33502)</li> <li> nodejs-trim-newlines: ReDoS in .end() method (CVE-2021-33623)</li> <li> nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)</li> <li> html-parse-stringify: Regular Expression DoS (CVE-2021-23346)</li> <li> openssl: incorrect SSLv2 rollback protection (CVE-2021-23839)</li> For more details about the security issues, including the impact, a CVSS<br>score, acknowledgments, and other related information, refer to the CVE<br>pages listed in the References section.<br>Bugs:<br><li> RFE Make the source code for the endpoint-metrics-operator public (BZ# 1913444)</li> <li> cluster became offline after apiserver health check (BZ# 1942589)</li>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2021:3016