Advisory Published

RHSA-2022:1476: Moderate: Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes

First published: Wed Apr 20 2022(Updated: )

Red Hat Advanced Cluster Management for Kubernetes 2.4.3 images<br>Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in.<br>This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide some security fixes and bug fixes. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release:<br><a href="https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/" target="_blank">https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/</a> Security updates:<br><li> golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565)</li> <li> nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account (CVE-2022-24450)</li> <li> nanoid: Information disclosure via valueOf() function (CVE-2021-23566)</li> <li> nodejs-shelljs: improper privilege management (CVE-2022-0144)</li> <li> search-ui-container: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor (CVE-2022-0155)</li> <li> node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)</li> <li> follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536)</li> <li> openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)</li> <li> imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path (CVE-2022-24778)</li> <li> golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)</li> <li> opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)</li> Related bugs:<br><li> RHACM 2.4.3 image files (BZ #2057249)</li> <li> Observability - dashboard name contains `/` would cause error when generating dashboard cm (BZ #2032128)</li> <li> ACM application placement fails after renaming the application name (BZ #2033051)</li> <li> Disable the obs metric collect should not impact the managed cluster upgrade (BZ #2039197)</li> <li> Observability - cluster list should only contain OCP311 cluster on OCP311 dashboard (BZ #2039820)</li> <li> The value of name label changed from clusterclaim name to cluster name (BZ #2042223)</li> <li> VMWare Cluster creation does not accept ecdsa-sha2-nistp521 ssh keys (BZ #2048500)</li> <li> clusterSelector matchLabels spec are cleared when changing app name/namespace during creating an app in UI (BZ #2053211)</li> <li> Application cluster status is not updated in UI after restoring (BZ #2053279)</li> <li> OpenStack cluster creation is using deprecated floating IP config for 4.7+ (BZ #2056610)</li> <li> The value of Vendor reported by cluster metrics was Other even if the vendor label in managedcluster was Openshift (BZ #2059039)</li> <li> Subscriptions stop reconciling after channel secrets are recreated (BZ #2059954)</li> <li> Placementrule is not reconciling on a new fresh environment (BZ #2074156)</li> <li> The cluster claimed from clusterpool cannot auto imported (BZ #2074543)</li>

Affected SoftwareAffected VersionHow to fix
Red Hat Advanced Cluster Management

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Reference Links

Frequently Asked Questions

  • What is the severity of RHSA-2022:1476?

    The severity of RHSA-2022:1476 is classified as important.

  • How do I fix RHSA-2022:1476?

    To fix RHSA-2022:1476, it is recommended to update to the latest version of Red Hat Advanced Cluster Management for Kubernetes.

  • What vulnerabilities are addressed in RHSA-2022:1476?

    RHSA-2022:1476 addresses multiple security vulnerabilities that could impact the integrity and availability of the Red Hat Advanced Cluster Management for Kubernetes.

  • Which version of Red Hat Advanced Cluster Management for Kubernetes is affected by RHSA-2022:1476?

    RHSA-2022:1476 affects version 2.4.3 of Red Hat Advanced Cluster Management for Kubernetes.

  • Is RHSA-2022:1476 related to Kubernetes security?

    Yes, RHSA-2022:1476 is related to Kubernetes security, specifically for the Advanced Cluster Management tool.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203