-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Service Interconnect 1.4 Release security update
Advisory ID:       RHSA-2023:4003-01
Product:           Red Hat Service Interconnect
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4003
Issue date:        2023-07-10
CVE Names:         CVE-2022-2879 CVE-2022-2880 CVE-2022-28327 
                   CVE-2022-41715 CVE-2022-41723 CVE-2022-41724 
                   CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 
                   CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 
                   CVE-2023-29400 
====================================================================
1. Summary:

This is release 1.4 of the rpms for Red Hat Service Interconnect. Red Hat
Service Interconnect 1.4 introduces a service network, linking TCP and HTTP
services across the hybrid cloud.
A service network enables communication between services running in
different network locations or sites. It allows geographically distributed
services to connect as if they were all running in the same site.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

8Base-Service-Interconnect-1 - noarch, x86_64
9Base-Service-Interconnect-1 - noarch, x86_64

3. Description:

As a Kubernetes user, I cannot connect easily connect services from one
cluster with services on another cluster. Red Hat Application Interconnect
enables me to create a service network and it allows geographically
distributed services to connect as if they were all running in the same
site.

Security Fix(es):

* golang: archive/tar: unbounded memory consumption when reading headers(CVE-2022-2879)

* golang: net/http/httputil: ReverseProxy should not forward unparseable
query parameters (CVE-2022-2880)

* golang: crypto/elliptic: panic caused by oversized scalar
(CVE-2022-28327)

* golang: regexp/syntax: limit memory used by parsing regexps
(CVE-2022-41715)

* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK
decoding (CVE-2022-41723)

* golang: crypto/tls: large handshake records may cause panics
(CVE-2022-41724)

* golang: net/http, mime/multipart: denial of service from excessive
resource consumption (CVE-2022-41725)

* golang: net/http, net/textproto: denial of service from excessive memory
allocation (CVE-2023-24534)

* golang: net/http, net/textproto, mime/multipart: denial of service from
excessive resource consumption (CVE-2023-24536)

* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

* golang: html/template: backticks not treated as string delimiters(CVE-2023-24538)

* golang: html/template: improper sanitization of CSS values
(CVE-2023-24539)

* golang: html/template: improper handling of empty HTML attributes
(CVE-2023-29400)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2077689 - CVE-2022-28327 golang: crypto/elliptic: panic caused by oversized scalar
2132867 - CVE-2022-2879 golang: archive/tar: unbounded memory consumption when reading headers2132868 - CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters2132872 - CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding
2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption
2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics
2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation
2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing
2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values
2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes

6. Package List:

8Base-Service-Interconnect-1:

Source:
libwebsockets-4.3.1-1.el8ai.src.rpm
qpid-proton-0.37.0-2.el8ai.src.rpm
skupper-cli-1.4.1-2.el8.src.rpm
skupper-router-2.4.1-2.el8.src.rpm

noarch:
skupper-router-common-2.4.1-2.el8.noarch.rpm
skupper-router-docs-2.4.1-2.el8.noarch.rpm
skupper-router-tools-2.4.1-2.el8.noarch.rpm

x86_64:
libwebsockets-4.3.1-1.el8ai.x86_64.rpm
libwebsockets-debuginfo-4.3.1-1.el8ai.x86_64.rpm
libwebsockets-debugsource-4.3.1-1.el8ai.x86_64.rpm
libwebsockets-devel-4.3.1-1.el8ai.x86_64.rpm
python3-qpid-proton-0.37.0-2.el8ai.x86_64.rpm
python3-qpid-proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-c-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-c-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-c-devel-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-cpp-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-debugsource-0.37.0-2.el8ai.x86_64.rpm
rubygem-qpid_proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm
skupper-cli-1.4.1-2.el8.x86_64.rpm
skupper-router-2.4.1-2.el8.x86_64.rpm
skupper-router-debuginfo-2.4.1-2.el8.x86_64.rpm
skupper-router-debugsource-2.4.1-2.el8.x86_64.rpm

9Base-Service-Interconnect-1:

Source:
jsoncpp-1.9.4-3.el9.src.rpm
libwebsockets-4.3.1-1.el9ai.src.rpm
qpid-proton-0.37.0-2.el9ai.src.rpm
skupper-cli-1.4.1-2.el9.src.rpm
skupper-router-2.4.1-2.el9.src.rpm

noarch:
skupper-router-common-2.4.1-2.el9.noarch.rpm
skupper-router-docs-2.4.1-2.el9.noarch.rpm
skupper-router-tools-2.4.1-2.el9.noarch.rpm

x86_64:
jsoncpp-1.9.4-3.el9.x86_64.rpm
jsoncpp-debuginfo-1.9.4-3.el9.x86_64.rpm
jsoncpp-debugsource-1.9.4-3.el9.x86_64.rpm
jsoncpp-devel-1.9.4-3.el9.x86_64.rpm
libwebsockets-4.3.1-1.el9ai.x86_64.rpm
libwebsockets-debuginfo-4.3.1-1.el9ai.x86_64.rpm
libwebsockets-debugsource-4.3.1-1.el9ai.x86_64.rpm
libwebsockets-devel-4.3.1-1.el9ai.x86_64.rpm
python3-qpid-proton-0.37.0-2.el9ai.x86_64.rpm
python3-qpid-proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-c-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-c-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-c-devel-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-cpp-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-cpp-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-cpp-devel-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-debugsource-0.37.0-2.el9ai.x86_64.rpm
rubygem-qpid_proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm
skupper-cli-1.4.1-2.el9.x86_64.rpm
skupper-router-2.4.1-2.el9.x86_64.rpm
skupper-router-debuginfo-2.4.1-2.el9.x86_64.rpm
skupper-router-debugsource-2.4.1-2.el9.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-2879
https://access.redhat.com/security/cve/CVE-2022-2880
https://access.redhat.com/security/cve/CVE-2022-28327
https://access.redhat.com/security/cve/CVE-2022-41715
https://access.redhat.com/security/cve/CVE-2022-41723
https://access.redhat.com/security/cve/CVE-2022-41724
https://access.redhat.com/security/cve/CVE-2022-41725
https://access.redhat.com/security/cve/CVE-2023-24534
https://access.redhat.com/security/cve/CVE-2023-24536
https://access.redhat.com/security/cve/CVE-2023-24537
https://access.redhat.com/security/cve/CVE-2023-24538
https://access.redhat.com/security/cve/CVE-2023-24539
https://access.redhat.com/security/cve/CVE-2023-29400
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_service_interconnect

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJkrCiuAAoJENzjgjWX9erEM2gP/2vUJQvf383OISO9rO36AQ/J
CpvJsVopoqPsOM9efR4Wlj272mPOGAn2dih6ZBqEX2nvCwrP3yKExqhy1b6k+36M
dXBG2ZAp7bLKbfp4Q+FPSBcHx/TRnS9cWkQ5O7bNroZKAxA6eqv73peiGAWf3B+L
8GHRrZkniv0X+oiWTASrziEfjuUta4GhhIQxnDMt2vAj62zN+PNTULtgOkG0o8E3
7mnL5aJ48JgaPk8SiZNlozE6gVPpUYFCkzM9IIq+LrLLS0hXSiJGv6vRB1NTMmgy
5YrXqbo/xKsZtFGJgXb3OPO+tRBvisDenkSIZ9XCeKWM/duuSXPfjctsVDgVtOkt
gK6sAy9D3Tug6oXNIUZpKh0/ndyxwTjXG3GEHlQOdvuCH7OpIhkBKiDFxKbQHNqj
1tf3PmKDkArTRC7DTAD3Q+pYuDJgu5/PMBZLvp4Ok7TXODPlCKUlp+PC/CLcBi4w
kmJIn6n0G05JcnBCbSV0pHY+z/QGfNQwB4AL5Pg9AAq4vYZis0nlg8OBJ8Xyih00
tzajFvLXPbJ4DJ+wcopzQFB/HJ/m/F4uH9z9+b73QigiomCs8MWLXRvfDO2GkOkK
KkiPj9RWrcXBuCOwPXVVJi9/bwGPT7tufXWei+X1WwBqf537Tkg9r001EOvGtzSc
LJnVw0+s1xYM+2cYsVa5
=OCZA
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2023-4003:01 Moderate: Red Hat Service Interconnect 1.4 Release

This is release 1.4 of the rpms for Red Hat Service Interconnect

Summary

As a Kubernetes user, I cannot connect easily connect services from one cluster with services on another cluster. Red Hat Application Interconnect enables me to create a service network and it allows geographically distributed services to connect as if they were all running in the same site.
Security Fix(es):
* golang: archive/tar: unbounded memory consumption when reading headers(CVE-2022-2879)
* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
* golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327)
* golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
* golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
* golang: html/template: backticks not treated as string delimiters(CVE-2023-24538)
* golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
* golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2022-2879 https://access.redhat.com/security/cve/CVE-2022-2880 https://access.redhat.com/security/cve/CVE-2022-28327 https://access.redhat.com/security/cve/CVE-2022-41715 https://access.redhat.com/security/cve/CVE-2022-41723 https://access.redhat.com/security/cve/CVE-2022-41724 https://access.redhat.com/security/cve/CVE-2022-41725 https://access.redhat.com/security/cve/CVE-2023-24534 https://access.redhat.com/security/cve/CVE-2023-24536 https://access.redhat.com/security/cve/CVE-2023-24537 https://access.redhat.com/security/cve/CVE-2023-24538 https://access.redhat.com/security/cve/CVE-2023-24539 https://access.redhat.com/security/cve/CVE-2023-29400 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_service_interconnect

Package List

8Base-Service-Interconnect-1:
Source: libwebsockets-4.3.1-1.el8ai.src.rpm qpid-proton-0.37.0-2.el8ai.src.rpm skupper-cli-1.4.1-2.el8.src.rpm skupper-router-2.4.1-2.el8.src.rpm
noarch: skupper-router-common-2.4.1-2.el8.noarch.rpm skupper-router-docs-2.4.1-2.el8.noarch.rpm skupper-router-tools-2.4.1-2.el8.noarch.rpm
x86_64: libwebsockets-4.3.1-1.el8ai.x86_64.rpm libwebsockets-debuginfo-4.3.1-1.el8ai.x86_64.rpm libwebsockets-debugsource-4.3.1-1.el8ai.x86_64.rpm libwebsockets-devel-4.3.1-1.el8ai.x86_64.rpm python3-qpid-proton-0.37.0-2.el8ai.x86_64.rpm python3-qpid-proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm qpid-proton-c-0.37.0-2.el8ai.x86_64.rpm qpid-proton-c-debuginfo-0.37.0-2.el8ai.x86_64.rpm qpid-proton-c-devel-0.37.0-2.el8ai.x86_64.rpm qpid-proton-cpp-debuginfo-0.37.0-2.el8ai.x86_64.rpm qpid-proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm qpid-proton-debugsource-0.37.0-2.el8ai.x86_64.rpm rubygem-qpid_proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm skupper-cli-1.4.1-2.el8.x86_64.rpm skupper-router-2.4.1-2.el8.x86_64.rpm skupper-router-debuginfo-2.4.1-2.el8.x86_64.rpm skupper-router-debugsource-2.4.1-2.el8.x86_64.rpm
9Base-Service-Interconnect-1:
Source: jsoncpp-1.9.4-3.el9.src.rpm libwebsockets-4.3.1-1.el9ai.src.rpm qpid-proton-0.37.0-2.el9ai.src.rpm skupper-cli-1.4.1-2.el9.src.rpm skupper-router-2.4.1-2.el9.src.rpm
noarch: skupper-router-common-2.4.1-2.el9.noarch.rpm skupper-router-docs-2.4.1-2.el9.noarch.rpm skupper-router-tools-2.4.1-2.el9.noarch.rpm
x86_64: jsoncpp-1.9.4-3.el9.x86_64.rpm jsoncpp-debuginfo-1.9.4-3.el9.x86_64.rpm jsoncpp-debugsource-1.9.4-3.el9.x86_64.rpm jsoncpp-devel-1.9.4-3.el9.x86_64.rpm libwebsockets-4.3.1-1.el9ai.x86_64.rpm libwebsockets-debuginfo-4.3.1-1.el9ai.x86_64.rpm libwebsockets-debugsource-4.3.1-1.el9ai.x86_64.rpm libwebsockets-devel-4.3.1-1.el9ai.x86_64.rpm python3-qpid-proton-0.37.0-2.el9ai.x86_64.rpm python3-qpid-proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm qpid-proton-c-0.37.0-2.el9ai.x86_64.rpm qpid-proton-c-debuginfo-0.37.0-2.el9ai.x86_64.rpm qpid-proton-c-devel-0.37.0-2.el9ai.x86_64.rpm qpid-proton-cpp-0.37.0-2.el9ai.x86_64.rpm qpid-proton-cpp-debuginfo-0.37.0-2.el9ai.x86_64.rpm qpid-proton-cpp-devel-0.37.0-2.el9ai.x86_64.rpm qpid-proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm qpid-proton-debugsource-0.37.0-2.el9ai.x86_64.rpm rubygem-qpid_proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm skupper-cli-1.4.1-2.el9.x86_64.rpm skupper-router-2.4.1-2.el9.x86_64.rpm skupper-router-debuginfo-2.4.1-2.el9.x86_64.rpm skupper-router-debugsource-2.4.1-2.el9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2023:4003-01
Product: Red Hat Service Interconnect
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4003
Issued Date: : 2023-07-10
CVE Names: CVE-2022-2879 CVE-2022-2880 CVE-2022-28327 CVE-2022-41715 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-29400

Topic

This is release 1.4 of the rpms for Red Hat Service Interconnect. Red HatService Interconnect 1.4 introduces a service network, linking TCP and HTTPservices across the hybrid cloud.A service network enables communication between services running indifferent network locations or sites. It allows geographically distributedservices to connect as if they were all running in the same site.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

8Base-Service-Interconnect-1 - noarch, x86_64

9Base-Service-Interconnect-1 - noarch, x86_64


Bugs Fixed

2077689 - CVE-2022-28327 golang: crypto/elliptic: panic caused by oversized scalar

2132867 - CVE-2022-2879 golang: archive/tar: unbounded memory consumption when reading headers2132868 - CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters2132872 - CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps

2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding

2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption

2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics

2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption

2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation

2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing

2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values

2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes


Related News

The End of the Road for Linux 6.11: A Call to Upgrade to Kernel 6.12
3 - 5 min read
The Linux kernel community recently issued an EOL announcement regarding the 6.11 kernel series, urging sysadmins to upgrade quickly to 6.12 . This
A Linux Admin
3 - 6 min read
As 2025 approaches, we Linux admins are facing new and often unseen cloud-native security obstacles. While skilled at mitigating known risks,
Leveraging Insights from the Linux Foundation
3 - 5 min read
The Linux Foundation's recent Census III report provides critical insights for Linux administrators, information security professionals, and anyone
Chrome 131 Released: Emergency Security Update Fixes Over a Dozen Significant Vulns
3 - 6 min read
Google recently unveiled a critical security update to their popular web browser, Google Chrome, addressing over a dozen significant security
From Wayland Fixes to Security Boosts: Examining Qt 6.8.1
3 - 6 min read
The recent Qt 6.8.1 release brings significant updates and improvements, strengthening its reputation as a secure and reliable application
Exploring Arch Linux 2024.12.01: Security Implications & Notable Enhancements for Linux Admins
3 - 6 min read
The Arch Linux 2024.12.01 ISO release marks an impressive milestone, offering cutting-edge updates that enhance functionality, streamline
Deck the Halls with Enhanced Security: Linux Kernel 6.13
3 - 5 min read
As Linux admins and infosec professionals prepare for the holiday season, there's much cause for celebration this year! Linus Torvalds recently made
Lessons from Bootkitty: Securing Linux Systems Against UEFI Intrusions
3 - 5 min read
New Linux security threats mark critical junctures that challenge existing policies and test security protocols to their limit. One such milestone

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved