—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3869
Red Hat Service Interconnect 1.4 Release security update
11 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: Red Hat Service Interconnect 1.4 Release
Publisher: Red Hat
Operating System: Red Hat
Resolution: Patch/Upgrade
CVE Names: CVE-2023-29400 CVE-2023-24539 CVE-2023-24538
CVE-2023-24537 CVE-2023-24536 CVE-2023-24534
CVE-2022-41725 CVE-2022-41724 CVE-2022-41723
CVE-2022-41715 CVE-2022-28327 CVE-2022-2880
CVE-2022-2879
Original Bulletin:
https://access.redhat.com/errata/RHSA-2023:4003
Comment: CVSS (Max): 7.5 CVE-2023-24537 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
– ————————–BEGIN INCLUDED TEXT——————–
– —–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat Service Interconnect 1.4 Release security update
Advisory ID: RHSA-2023:4003-01
Product: Red Hat Service Interconnect
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4003
Issue date: 2023-07-10
CVE Names: CVE-2022-2879 CVE-2022-2880 CVE-2022-28327
CVE-2022-41715 CVE-2022-41723 CVE-2022-41724
CVE-2022-41725 CVE-2023-24534 CVE-2023-24536
CVE-2023-24537 CVE-2023-24538 CVE-2023-24539
CVE-2023-29400
=====================================================================
1. Summary:
This is release 1.4 of the rpms for Red Hat Service Interconnect. Red Hat
Service Interconnect 1.4 introduces a service network, linking TCP and HTTP
services across the hybrid cloud.
A service network enables communication between services running in
different network locations or sites. It allows geographically distributed
services to connect as if they were all running in the same site.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
8Base-Service-Interconnect-1 – noarch, x86_64
9Base-Service-Interconnect-1 – noarch, x86_64
3. Description:
As a Kubernetes user, I cannot connect easily connect services from one
cluster with services on another cluster. Red Hat Application Interconnect
enables me to create a service network and it allows geographically
distributed services to connect as if they were all running in the same
site.
Security Fix(es):
* golang: archive/tar: unbounded memory consumption when reading headers
(CVE-2022-2879)
* golang: net/http/httputil: ReverseProxy should not forward unparseable
query parameters (CVE-2022-2880)
* golang: crypto/elliptic: panic caused by oversized scalar
(CVE-2022-28327)
* golang: regexp/syntax: limit memory used by parsing regexps
(CVE-2022-41715)
* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK
decoding (CVE-2022-41723)
* golang: crypto/tls: large handshake records may cause panics
(CVE-2022-41724)
* golang: net/http, mime/multipart: denial of service from excessive
resource consumption (CVE-2022-41725)
* golang: net/http, net/textproto: denial of service from excessive memory
allocation (CVE-2023-24534)
* golang: net/http, net/textproto, mime/multipart: denial of service from
excessive resource consumption (CVE-2023-24536)
* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
* golang: html/template: backticks not treated as string delimiters
(CVE-2023-24538)
* golang: html/template: improper sanitization of CSS values
(CVE-2023-24539)
* golang: html/template: improper handling of empty HTML attributes
(CVE-2023-29400)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
2077689 – CVE-2022-28327 golang: crypto/elliptic: panic caused by oversized scalar
2132867 – CVE-2022-2879 golang: archive/tar: unbounded memory consumption when reading headers
2132868 – CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
2132872 – CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
2178358 – CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding
2178488 – CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption
2178492 – CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics
2184481 – CVE-2023-24538 golang: html/template: backticks not treated as string delimiters
2184482 – CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
2184483 – CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation
2184484 – CVE-2023-24537 golang: go/parser: Infinite loop in parsing
2196026 – CVE-2023-24539 golang: html/template: improper sanitization of CSS values
2196029 – CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes
6. Package List:
8Base-Service-Interconnect-1:
Source:
libwebsockets-4.3.1-1.el8ai.src.rpm
qpid-proton-0.37.0-2.el8ai.src.rpm
skupper-cli-1.4.1-2.el8.src.rpm
skupper-router-2.4.1-2.el8.src.rpm
noarch:
skupper-router-common-2.4.1-2.el8.noarch.rpm
skupper-router-docs-2.4.1-2.el8.noarch.rpm
skupper-router-tools-2.4.1-2.el8.noarch.rpm
x86_64:
libwebsockets-4.3.1-1.el8ai.x86_64.rpm
libwebsockets-debuginfo-4.3.1-1.el8ai.x86_64.rpm
libwebsockets-debugsource-4.3.1-1.el8ai.x86_64.rpm
libwebsockets-devel-4.3.1-1.el8ai.x86_64.rpm
python3-qpid-proton-0.37.0-2.el8ai.x86_64.rpm
python3-qpid-proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-c-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-c-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-c-devel-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-cpp-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-debugsource-0.37.0-2.el8ai.x86_64.rpm
rubygem-qpid_proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm
skupper-cli-1.4.1-2.el8.x86_64.rpm
skupper-router-2.4.1-2.el8.x86_64.rpm
skupper-router-debuginfo-2.4.1-2.el8.x86_64.rpm
skupper-router-debugsource-2.4.1-2.el8.x86_64.rpm
9Base-Service-Interconnect-1:
Source:
jsoncpp-1.9.4-3.el9.src.rpm
libwebsockets-4.3.1-1.el9ai.src.rpm
qpid-proton-0.37.0-2.el9ai.src.rpm
skupper-cli-1.4.1-2.el9.src.rpm
skupper-router-2.4.1-2.el9.src.rpm
noarch:
skupper-router-common-2.4.1-2.el9.noarch.rpm
skupper-router-docs-2.4.1-2.el9.noarch.rpm
skupper-router-tools-2.4.1-2.el9.noarch.rpm
x86_64:
jsoncpp-1.9.4-3.el9.x86_64.rpm
jsoncpp-debuginfo-1.9.4-3.el9.x86_64.rpm
jsoncpp-debugsource-1.9.4-3.el9.x86_64.rpm
jsoncpp-devel-1.9.4-3.el9.x86_64.rpm
libwebsockets-4.3.1-1.el9ai.x86_64.rpm
libwebsockets-debuginfo-4.3.1-1.el9ai.x86_64.rpm
libwebsockets-debugsource-4.3.1-1.el9ai.x86_64.rpm
libwebsockets-devel-4.3.1-1.el9ai.x86_64.rpm
python3-qpid-proton-0.37.0-2.el9ai.x86_64.rpm
python3-qpid-proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-c-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-c-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-c-devel-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-cpp-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-cpp-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-cpp-devel-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-debugsource-0.37.0-2.el9ai.x86_64.rpm
rubygem-qpid_proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm
skupper-cli-1.4.1-2.el9.x86_64.rpm
skupper-router-2.4.1-2.el9.x86_64.rpm
skupper-router-debuginfo-2.4.1-2.el9.x86_64.rpm
skupper-router-debugsource-2.4.1-2.el9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2022-2879
https://access.redhat.com/security/cve/CVE-2022-2880
https://access.redhat.com/security/cve/CVE-2022-28327
https://access.redhat.com/security/cve/CVE-2022-41715
https://access.redhat.com/security/cve/CVE-2022-41723
https://access.redhat.com/security/cve/CVE-2022-41724
https://access.redhat.com/security/cve/CVE-2022-41725
https://access.redhat.com/security/cve/CVE-2023-24534
https://access.redhat.com/security/cve/CVE-2023-24536
https://access.redhat.com/security/cve/CVE-2023-24537
https://access.redhat.com/security/cve/CVE-2023-24538
https://access.redhat.com/security/cve/CVE-2023-24539
https://access.redhat.com/security/cve/CVE-2023-29400
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_service_interconnect
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
– —–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCAAGBQJkrCiuAAoJENzjgjWX9erEM2gP/2vUJQvf383OISO9rO36AQ/J
CpvJsVopoqPsOM9efR4Wlj272mPOGAn2dih6ZBqEX2nvCwrP3yKExqhy1b6k+36M
dXBG2ZAp7bLKbfp4Q+FPSBcHx/TRnS9cWkQ5O7bNroZKAxA6eqv73peiGAWf3B+L
8GHRrZkniv0X+oiWTASrziEfjuUta4GhhIQxnDMt2vAj62zN+PNTULtgOkG0o8E3
7mnL5aJ48JgaPk8SiZNlozE6gVPpUYFCkzM9IIq+LrLLS0hXSiJGv6vRB1NTMmgy
5YrXqbo/xKsZtFGJgXb3OPO+tRBvisDenkSIZ9XCeKWM/duuSXPfjctsVDgVtOkt
gK6sAy9D3Tug6oXNIUZpKh0/ndyxwTjXG3GEHlQOdvuCH7OpIhkBKiDFxKbQHNqj
1tf3PmKDkArTRC7DTAD3Q+pYuDJgu5/PMBZLvp4Ok7TXODPlCKUlp+PC/CLcBi4w
kmJIn6n0G05JcnBCbSV0pHY+z/QGfNQwB4AL5Pg9AAq4vYZis0nlg8OBJ8Xyih00
tzajFvLXPbJ4DJ+wcopzQFB/HJ/m/F4uH9z9+b73QigiomCs8MWLXRvfDO2GkOkK
KkiPj9RWrcXBuCOwPXVVJi9/bwGPT7tufXWei+X1WwBqf537Tkg9r001EOvGtzSc
LJnVw0+s1xYM+2cYsVa5
=OCZA
– —–END PGP SIGNATURE—–
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZKzGb8kNZI30y1K9AQgcKQ/6AjJVnd23IecXPvlVF4UNzUY9/LpGK/3H
BYnV9KfzQwjT/WOIruQe4sBG+YQZ20/9pN1KvFWu2YVIqAAX8bH/7ZBcA+AqndvR
nSd6NWJhpNEo9Fzy00guvWZ9Few/j/ov80+TRqfHVvXvXdYpvvCVrlil/axyQ71D
1Un5aAHUFOqVZtGvwwxO9MeGyimTxA62DtP8jWiIX/PzdWu/N1OzbHmJ1+lduhpD
NF0+R6jPu20/avG1fa8tWnAeAhtmwH/QnYYlkPfKBrQ4TP3+WTJXt6cjyz5516Dp
iRQrwFk3JOCuapqymG1B9bfoX2fqNkgrl5iVWTatqg+4CuRC+Er/YZtjQ/Q+N7KC
W47nt/9alepOOVRuRzHOuNLunLvmRKhPqwg0yYbwzUio2flN4eYBMJA5oY3yvLgr
VFEZKg+RCVEvHCiX0TadfpYoAX+VlH7nqBSDBF9vzZCuDNblsE2WRWjnBAx48dWE
saEBwytIAuFQI2XX+lxqoQwrDLys+rB4I7rDlNW8Eq4W5TuUuhUiCyEJXPiL00K1
/QHwOF7jeFTWPRhcITbMN3PSPpwBYGbUJO+f8eOs99assUPyQNlxouaid6oyvBpq
bofL3u1Ef8FwMe+DI6cDzIGolGL8E3WnQU0J5iGL2QsjOzGQ6SbZfQW7LNlwCUhP
98tgZ3AkFtA=
=2qC0
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins