Important: Migration Toolkit for Applications security and bug fix update

Topic

Migration Toolkit for Applications 6.2.0 release

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Migration Toolkit for Applications 6.2.0 Images

Security Fix(es):

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)
• undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492)
• x/net/http2/h4c: request smuggling (CVE-2022-41721)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• dev-java/snakeyaml: DoS via stack overflow (CVE-2022-41854)
• codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS (CVE-2022-41881)
• htmlUnit: Stack overflow crash causes Denial of Service (DoS) (CVE-2023-2798)
• zip4j: does not always check the MAC when decrypting a ZIP archive (CVE-2023-22899)
• golang: crypto/internal/nistec: specific unreduced P-256 scalars produce incorrect results (CVE-2023-24532)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• golang-github-gin-gonic-gin: Improper Input Validation (CVE-2023-26125)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• fast-xml-parser: Regex Injection via Doctype Entities (CVE-2023-34104)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Migration Toolkit for Applications 1 x86_64

Fixes

• BZ - 2151988 - CVE-2022-41854 dev-java/snakeyaml: DoS via stack overflow
• BZ - 2153260 - CVE-2022-4492 undertow: Server identity in https connection is not checked by the undertow client
• BZ - 2153379 - CVE-2022-41881 codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS
• BZ - 2162182 - CVE-2022-41721 x/net/http2/h4c: request smuggling
• BZ - 2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding
• BZ - 2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption
• BZ - 2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics
• BZ - 2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters
• BZ - 2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
• BZ - 2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation
• BZ - 2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing
• BZ - 2185278 - CVE-2023-22899 zip4j: does not always check the MAC when decrypting a ZIP archive
• BZ - 2185707 - CVE-2021-46877 jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode
• BZ - 2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values
• BZ - 2196027 - CVE-2023-24540 golang: html/template: improper handling of JavaScript whitespace
• BZ - 2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes
• BZ - 2203769 - CVE-2023-26125 golang-github-gin-gonic-gin: Improper Input Validation
• BZ - 2210366 - CVE-2023-2798 htmlUnit: Stack overflow crash causes Denial of Service (DoS)
• BZ - 2221261 - CVE-2023-34104 fast-xml-parser: Regex Injection via Doctype Entities
• BZ - 2223355 - CVE-2023-24532 golang: crypto/internal/nistec: specific unreduced P-256 scalars produce incorrect results
• MTA-1015 - Credentials filtering is missing 'Created by' filter
• MTA-1041 - Application inventory page crashes when deleting an application and the right panel is open
• MTA-194 - [RFE] Present a data in more readable format
• MTA-465 - Tags & Reports tabs for the application keeps loading while analysis in progress.
• MTA-477 - Applications imported even after showing Rejected in "Manage Imports" page.
• MTA-483 - EAP6 still present as a target in downstream MTA builds 6.1.0
• MTA-485 - [UI] Filter category by name list is too long
• MTA-590 - Identified risk table shows error when there are no data
• MTA-682 - [Upstream][Custom Metrics] Initiated assessments total count isn't working correctly
• MTA-706 - [Upstream] [Migration Waves] Date fields can't be entered manually
• MTA-741 - [Migration Waves] start date value is not updated correctly
• MTA-761 - eap targets listed as konveyor.io/target=eapx on Analysis dialog
• MTA-773 - Render analysis details as YAML for better readability.
• MTA-802 - [Regresssion] Tag list under Tag Category doesn't get updated after new tag creation
• MTA-870 - A Migration Wave cannot be exported as a SubTask - using both Jira Datacenter and Cloud
• MTA-872 - After an error ,trying to export the same applications as tasks , fails with an error showing sub-tasks.
• MTA-873 - Exporting migration wave as an Epic does not export it to Jira - using Jira Server/Datacenter
• MTA-877 - in migration waves when exporting a migration wave to jira, and moving the ticket to done it changes status to "Not Started"
• MTA-894 - [Custom metrics] Failed analysis is counted twice
• MTA-898 - [UI] Incorrect tooltip when the bulk deletion button is disabled on application inventory page
• MTA-906 - Migration Waves: The Name field doesn't have the "too sort" validation
• MTA-912 - in migration waves - after applying wrong dates, correcting the dates does not remove the error message
• MTA-916 - Application Inventory : Sorting applications on tag count is broken
• MTA-923 - in migration waves - when creating two migration waves with same name and same dates - once trying to create the second one an error pops "Failed to create migration wave."
• MTA-937 - in migration waves - selecting one migration wave using individual check box will automatically select all applications with the same name
• MTA-943 - [UI] Incorrect sorting in reports
• MTA-973 - Jira Configuration: Success alert is missing while creating any new jira instance
• MTA-974 - Success notification text starts with lowercase
• MTA-984 - Dependencies: Unable to Connect there is an error retrieving data
• MTA-985 - [Custom rules in analysis] Enforce URL validation for git repo
• MTA-24 - [API][Application] ApiApplication returned from post method is missing the identities name
• MTA-27 - [API][Credentials] It is possible to create more than one credential with the same name
• MTA-464 - [Custom rules] Analysis wizard stucks on custom rules page on moving "Back" from Repository tab.
• MTA-468 - Incorrect description for Azure target.
• MTA-469 - Typo under Reports -> Current Landscape UI
• MTA-470 - [UI] Clear Repository button is taking few seconds to re-enable every time when we switch to different tab or perspective.
• MTA-472 - [Reports][RFE] "MIGRATION TOOLKIT FOR APPLICATIONS" can be renamed to "Migration Toolkit for Applications"
• MTA-474 - Validation issue with "Password" field when creating a new Credential
• MTA-476 - Tooltip text for the disabled "Delete" button under "Tags" is incorrect
• MTA-478 - Application Inventory page doesn't get updated after the "Import"
• MTA-479 - Category Color missing when Tag Category is created at the time of import
• MTA-480 - Unable to import application with multiple tags under a single tag category.
• MTA-481 - [RFE] Deleting a Job function associated with Stakeholder
• MTA-484 - Enforce URL validation for git repo while creating custom target
• MTA-500 - Missing space in OpenLiberty target description
• MTA-582 - [API] Job function crud and stakeholder group crud fails
• MTA-643 - [Upstream] Success alerts are broken
• MTA-647 - [Upstream] Remove Asterisk for member(s) while creating a stakeholder group
• MTA-651 - Application owner is sent if its added then manually deleted
• MTA-658 - [Upstream] Helper messages are displayed on blur
• MTA-659 - [Upstream] Source repository field accepts only git urls.
• MTA-674 - [RFE][API] Return reference "name" field from POST method
• MTA-678 - Operator failing smoke tests (6.2.0 / release-0.2)
• MTA-680 - [Upstream] [Typo] Migration waves wizard stakeholders groups' field should be in plural
• MTA-681 - [Upstream][RFE] Add a tooltip for delete button disabled only when selected application(s) are in a migration wave
• MTA-695 - Running a second migration wave export with additional apps errors out
• MTA-698 - [Upstream] Replace Jira Server/Datacenter options with a single option
• MTA-699 - [Upstream] Not able to connect to RedHat JIRA account
• MTA-717 - [Credentials] Save button remains disabled while editing credentials of Jira type
• MTA-739 - Add a tool tip to explain what insecure communication with a Jira instance is
• MTA-747 - Job function can't be removed
• MTA-750 - Applications cannot be selected in the Assessment tab of the Application Inventory
• MTA-753 - Some success notifications include two spaces
• MTA-764 - [UI] Incorrect tooltip when removing credentials
• MTA-765 - [UI] Incorrect tooltip when removing credentials
• MTA-766 - [UI] Incorrect labels in Jira connections table
• MTA-772 - [Upstream] Credentials of type 'Bearer' not listed in Jira instance creation dialog
• MTA-778 - Clicking ?'Show password' icon for Jira Bearer token key doesn't show the key.
• MTA-807 - [Custom metrics] The METRICS_ENABLED environment variable is overridden by its default value
• MTA-808 - [UI] Credentials field is empty when editing existing Jira connection instance
• MTA-809 - [Custom metrics] Exported issues which move from "Error" to "New" state are counted twice
• MTA-811 - Failed to delete an application that is associated with a ticket on the issues manager
• MTA-814 - [Typo] Application creation notification text starts with lowercase
• MTA-815 - [UI] Incrrect Jira instance type name is shown in Jira connection table
• MTA-826 - [Tags] Color filter isn't working correctly
• MTA-845 - CSV Reports cannot be downloaded
• MTA-863 - [UI] Jira credentials have different names in creation wizard and filtering
• MTA-881 - Stakeholder: Assertion is missing "No stakeholders available"
• MTA-895 - [UI] Sometimes Jira table doesn't look consistant with other tables
• MTA-908 - [UI] Incorrect sorting by URL for Jira instances
• MTA-909 - Tags: Tag Category field is missing helper message "This field is required."
• MTA-83 - CVE-2022-41881 org.jboss.windup.rules-windup-rulesets-parent: codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS [mta-6]
• MTA-91 - CVE-2022-41881 org.jboss.windup.plugin-windup-maven-plugin-parent: codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS [mta-6]
• MTA-81 - CVE-2022-41881 io.netty-netty-parent: codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS [mta-6]
• MTA-84 - CVE-2022-41854 dev-java-snakeyaml: dev-java/snakeyaml: DoS via stack overflow [mta-6]
• MTA-89 - CVE-2022-41881 org.jboss.windup-windup-parent: codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS [mta-6]
• MTA-93 - CVE-2022-4492 org.keycloak-keycloak-parent: undertow: Server identity in https connection is not checked by the undertow client [mta-6]

CVEs

• CVE-2021-46877
• CVE-2022-4492
• CVE-2022-41721
• CVE-2022-41723
• CVE-2022-41724
• CVE-2022-41725
• CVE-2022-41854
• CVE-2022-41881
• CVE-2023-2798
• CVE-2023-22899
• CVE-2023-24532
• CVE-2023-24534
• CVE-2023-24536
• CVE-2023-24537
• CVE-2023-24538
• CVE-2023-24539
• CVE-2023-24540
• CVE-2023-26125
• CVE-2023-29400
• CVE-2023-34104

References

• https://access.redhat.com/security/updates/classification/#important