Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.3906
Red Hat Kiali for OpenShift Service Mesh 2.0 security update
9 August 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat Kiali for OpenShift Service Mesh 2.0
Publisher: Red Hat
Operating System: Red Hat
Resolution: Patch/Upgrade
CVE Names: CVE-2022-31129
Original Bulletin:
https://access.redhat.com/errata/RHSA-2022:5913
Comment: CVSS (Max): 7.5 CVE-2022-31129 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat Kiali for OpenShift Service Mesh 2.0 security update
Advisory ID: RHSA-2022:5913-01
Product: Red Hat OpenShift Service Mesh
Advisory URL: https://access.redhat.com/errata/RHSA-2022:5913
Issue date: 2022-08-08
CVE Names: CVE-2022-31129
=====================================================================
1. Summary:
An update for openshift-istio-kiali-rhel8-container is now available for
OpenShift Service Mesh 2.0.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Description:
Red Hat Kiali for OpenShift Service Mesh is Red Hat's distribution of the
Istio service mesh project, tailored for installation into an on-premise
OpenShift Container Platform installation.
This advisory covers containers for the release.
Security Fix(es):
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
3. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
4. Bugs fixed (https://bugzilla.redhat.com/):
2105075 - CVE-2022-31129 moment: inefficient parsing algorithm resulting in DoS
5. JIRA issues fixed (https://issues.jboss.org/):
OSSM-1826 - Rebuild Kiali Server container 1.24 to pick up base image CVE fixes
6. References:
https://access.redhat.com/security/cve/CVE-2022-31129
https://access.redhat.com/security/updates/classification/#moderate
7. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYvD8NdzjgjWX9erEAQhH/A//dkJC9hOk1DuHGoeP63G+pANu++mC9CUC
MOg7X4rAq8K70dHHRaUsQj7GNf/waAh+z2BRTump8zNBA0QV9psNQFunSbvGLT0F
ImfhaZtXvotCEB/Dv9EdnQu04MuoXNTYXYJilAr7kpzll6tu2lNh4Q/lTPo4nFvs
uI6s0sop4wWnBsrWHVKbVLCKhtrZJCsI0xd5r36nGbBx80AL3wYaDmyu4ZiLEPTX
3600Bf13cg9s1fbk+lUwVhby9WyTJi/fUSxyBlUyDxYX6LTeyPl7rgt1VH9nH9e9
JevKENtBYAyvfvpajxg3r2XeQrE+WJwEOQVMQVtSDXW01rHzC4oRNT4/7oOmcvem
vvCj9eWarYtILH/RaRBIslU/ic9xb0P+cOp+y3WQ/aebczDZXt8jOBRfk99sGdjT
HdAlHJ3LuqsZUElhrV8RDh4371IaEFk18Y4cDp1KeZH0JMTTlMUUm5hZN7jL845Z
N45BY0nt+f82WB2tm5uN8aUFw6qz9vOhWiqOR5oYwZYUrble68qUbffMKW52dKEv
KxIyyf5Xel2MDueupLpPqSKbc1Btu1/5E/h6YSxanPZjh1S2nnC6CkCau5A94Pge
RE0e+g1+NPoNW4ORzhssve+Rp517sQIx3XTinlUiQTD4NgJojb065+CIsj4aW+eN
HDishDluEdU=
=JCIa
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBYvG/B8kNZI30y1K9AQgF4g//Zxn3tVOdhD139KMIb+xbtjemBtDQiQv6
DM1phSOSTcxe0yCK3LfagctHG2/To4mz3duO6MnS2T7v8aSQ7I/BE4b9ENG46UXr
OSEXS8GEHS7Pwp37NJHn0B49hw/mZFYlTRlX+AwbZM229rqyP9y2XhflWOLqGZLX
8GPFOZoF7gVLwmMIuelDdDJqgdH0umv55KLAGFJiC3qHQkI4eh5GsNvjAVEtXNdH
lM6CAa0dy/B7p0uveuB2mj0axN5YIlBJ8bhXKatKD3zmHxBA0k8kGeqZ+judjYyi
PukyxCghZsFr84EX9rXW+x9MUF+/rSIOSOEV8YLvJGHJ+T1UqK/PXI0VCr3YP62L
/86CQSn+bShZHm8yJTUi03uNlrAqucntBrrF2i/n6O+T2xh5J+psNAG5F+yRtRaw
igcc2qmakDjMT+r0BaUPibK2znRZ5gsWC3M/eK0izxcyJQ25bG0eTLypfg6yJC33
58hfKu7ba2qfE7NCNwNWS7nLQIUQRTIk5dhofCXCjwvfdqtF2ralEEz361CwpA5u
NEpLQOnziUbcEHhKNhxyuey0GDj6hp9L7QXu53Y6HyrcjP0eZfjlOqfJ8pXAch9M
Vvo+cv7Gm0wbiBoBK+T02BgKR0LNZYcyOIJAR5oy8P1DQgqt36KIVcoGFegptXaM
FbduhLeefK8=
=Vh1R
-----END PGP SIGNATURE-----