A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.
A flaw was found in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.
Red Hat Advanced Cluster Management for Kubernetes provides thecapabilities to address common challenges that administrators and sitereliability engineers face as they work across a range of public andprivate cloud environments. Clusters and applications are all visible andmanaged from a single console—with security policy built in.This advisory contains the container images for Red Hat Advanced ClusterManagement for Kubernetes, which add new features and enhancements, bugfixes, and updated container images. See the followingRelease Notes documentation, which will be updated shortly for thisrelease, for additional details about this release:https://docs.redhat.com/en/documentation/redhatadvancedclustermanagementforkubernetes/2.11/html-single/releasenotes/index#acm-release-notes
Red Hat Advanced Cluster Management for Kubernetes provides thecapabilities to address common challenges that administrators and sitereliability engineers face as they work across a range of public andprivate cloud environments. Clusters and applications are all visible andmanaged from a single console—with security policy built in.This advisory contains the container images for Red Hat Advanced ClusterManagement for Kubernetes, which add new features and enhancements, bugfixes, and updated container images. See the followingRelease Notes documentation, which will be updated shortly for thisrelease, for additional details about this release:https://docs.redhat.com/en/documentation/redhatadvancedclustermanagementforkubernetes/2.13/html-single/releasenotes/index#acm-release-notes
Red Hat Advanced Cluster Management for Kubernetes provides thecapabilities to address common challenges that administrators and sitereliability engineers face as they work across a range of public andprivate cloud environments. Clusters and applications are all visible andmanaged from a single console—with security policy built in.This advisory contains the container images for Red Hat Advanced ClusterManagement for Kubernetes, which add new features and enhancements, bugfixes, and updated container images. See the followingRelease Notes documentation, which will be updated shortly for thisrelease, for additional details about this release:https://docs.redhat.com/en/documentation/redhatadvancedclustermanagementforkubernetes/2.14/html-single/releasenotes/index#acm-release-notes
Important: Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
Important: Red Hat Advanced Cluster Management for Kubernetes 2.14.1 security update
Important: Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update
Important: Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update
Important: RHSA: Submariner 0.20.1 - bug fix and enhancement update
Important: Red Hat Advanced Cluster Management 2.13.3 fixes and container updates
Important: Red Hat Advanced Cluster Management 2.9.9 bug fixes and container updates
Important: RHSA: Submariner 0.18.5 - bug and security update
Important: Red Hat Advanced Cluster Management 2.11.7 container updates
Important: Red Hat Advanced Cluster Management 2.10.8 container updates
Important: RHSA: Submariner 0.19.4 - bug fix and enhancement update
Important: Red Hat Advanced Cluster Management 2.12.3 container image updates
Important: VolSync 0.11.2 security fixes and enhancements for RHEL 9
A Server-Side Request Forgery (SSRF) vulnerability was found in the console API endpoint from Red Hat Advanced Cluster Management for Kubernetes (RHACM). An attacker could take advantage of this as the console API endpoint is missing an authentication check, allowing unauthenticated users making requests.
Important: Red Hat Advanced Cluster Management 2.13.2 container image updates
Important: Red Hat Edge Manager Version 0.5.1 (Technology Preview) security fixes
Important: RHSA: Submariner 0.19.2 - bug fix and enhancement update
Important: Red Hat Advanced Cluster Management 2.12.2 security and bug fix updates
Important: RHSA: Submariner 0.17.5 - bug and security fixes
Important: Red Hat Advanced Cluster Management 2.11.5 bug fixes and container updates
Important: RHSA: Submariner 0.16.8 - bug and security fixes
Important: Red Hat Advanced Cluster Management 2.9.6 bug fixes and container updates
Important: RHSA: Submariner 0.18.4 - bug and security fixes
Important: VolSync 0.10.2 for RHEL 9
Moderate: Red Hat Advanced Cluster Management 2.11.4 security enhancements and bug fixes