A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
Important: Multicluster Engine for Kubernetes 2.4.9 security updates and bug fixes
Important: multicluster Engine for Kubernetes 2.6.7 container updates
Important: Multicluster Engine for Kubernetes 2.7.4 security updates
Important: multicluster engine for Kubernetes 2.8.1 container image updates
Important: Multicluster Engine for Kubernetes 2.6.5 security updates and bug fixes
Important: Multicluster Engine for Kubernetes 2.7.3 security updates and bug fixes
Important: Multicluster Engine for Kubernetes 2.5.8 security updates and bug fixes
Important: Multicluster Engine for Kubernetes 2.4.7 security updates and bug fixes
Moderate: Multicluster Engine for Kubernetes 2.6.4 security enhancements and bug fixes
Moderate: Multicluster Engine for Kubernetes 2.7.2 security updates and bug fixes
Important: Multicluster Engine for Kubernetes 2.3.8 bug fixes and container updates
Important: Multicluster Engine for Kubernetes 2.4.6 security updates and bug fixes
Moderate: Multicluster Engine for Kubernetes 2.6.3 security updates
Moderate: Multicluster Engine for Kubernetes 2.5.7 security updates and bug fixes
multicluster engine for Kubernetes v2.4.5 imagesmulticluster engine for Kubernetes provides the foundational componentsthat are necessary for the centralized management of multipleKubernetes-based clusters across data centers, public clouds, and privateclouds.You can use the engine to create new Red Hat OpenShift Container Platformclusters or to bring existing Kubernetes-based clusters under management byimporting them. After the clusters are managed, you can use the APIs thatare provided by the engine to distribute configuration based on placementpolicy.Jira issues addressed: ACM-10999 Import controller keeps refreshing the bootstrap hub kubeconfig ACM-9982 open-cluster-management-image-pull-credentials missing in open-cluster-management-agent-addon namespace in MCE 2.5.0-57
Multicluster engine for Kubernetes v2.5.3 imagesMulticluster engine for Kubernetes provides the foundational componentsthat are necessary for the centralized management of multipleKubernetes-based clusters across data centers, public clouds, and privateclouds.You can use the engine to create new Red Hat OpenShift Container Platformclusters or to bring existing Kubernetes-based clusters under management byimporting them. After the clusters are managed, you can use the APIs thatare provided by the engine to distribute configuration based on placementpolicy.Jira issues addressed: ACM-10580: HCP OpenShift Virtualization web console does not create clusters in HighAvailability mode
Multicluster engine for Kubernetes v2.5.2 imagesMulticluster engine for Kubernetes provides the foundational componentsthat are necessary for the centralized management of multipleKubernetes-based clusters across data centers, public clouds, and privateclouds.You can use the engine to create new Red Hat OpenShift Container Platformclusters or to bring existing Kubernetes-based clusters under management byimporting them. After the clusters are managed, you can use the APIs thatare provided by the engine to distribute configuration based on placementpolicy.
Important: Multicluster Engine for Kubernetes 2.2.9 security updates and bug fixes
Moderate: Multicluster Engine for Kubernetes 2.3.2 security updates and bug fixes
Critical: Multicluster Engine for Kubernetes 2.1.8 security updates and bug fixes
Critical: Multicluster Engine for Kubernetes 2.3.1 security updates and bug fixes
Critical: Multicluster Engine for Kubernetes 2.2.7 security updates and bug fixes
Critical: Multicluster Engine for Kubernetes 2.0.9 security fixes and container updates
Critical: Multicluster Engine for Kubernetes 2.1.7 security fixes and container updates
Critical: Multicluster Engine for Kubernetes 2.2.4 security fixes and container updates
Multicluster Engine for Kubernetes 2.0.8 imagesMulticluster engine for Kubernetes provides the foundational componentsthat are necessary for the centralized management of multipleKubernetes-based clusters across data centers, public clouds, and privateclouds.You can use the engine to create new Red Hat OpenShift Container Platformclusters or to bring existing Kubernetes-based clusters under management byimporting them. After the clusters are managed, you can use the APIs thatare provided by the engine to distribute configuration based on placementpolicy.Security fix(es): CVE-2022-25881 http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability
Multicluster Engine for Kubernetes 2.1.6 imagesMulticluster engine for Kubernetes provides the foundational componentsthat are necessary for the centralized management of multipleKubernetes-based clusters across data centers, public clouds, and privateclouds.You can use the engine to create new Red Hat OpenShift Container Platformclusters or to bring existing Kubernetes-based clusters under management byimporting them. After the clusters are managed, you can use the APIs thatare provided by the engine to distribute configuration based on placementpolicy.Jira issue addressed:ACM-3513: MCE 2.1.6 imagesSecurity fix(es): CVE-2022-25881 http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability
Security Fix(es) CVE-2023-29017 vm2: Sandbox Escape CVE-2023-29199 vm2: Sandbox Escape CVE-2023-30547 vm2: Sandbox Escape when exception sanitization
Security Fix(es) CVE-2023-29017 vm2: Sandbox Escape CVE-2023-29199 vm2: Sandbox Escape CVE-2023-30547 vm2: Sandbox Escape when exception sanitization