Moderate: Release of containers for Red Hat OpenStack Platform 17.1 director Operator

Topic

Red Hat OpenStack Platform 17.1 (Wallaby) director Operator containers are now available.

Description

Release of Red Hat OpenStack Platform 17.1 (Wallaby) director Operator containers provides these changes:

Security Fix(es):

• github.com/Masterminds/vcs: Command Injection via argument injection (CVE-2022-21235)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack 17.1 for RHEL 9 x86_64

Fixes

• BZ - 2215019 - Update osp-director-operator references to GA locations
• BZ - 2215317 - CVE-2022-21235 github.com/Masterminds/vcs: Command Injection via argument injection
• BZ - 2218299 - git url logic does not handle non-default ports and users
• BZ - 2221326 - Playbooks list is ignored for FFU and minor update
• OSPK8-701 - nil ptr can hide actual error

CVEs

• CVE-2022-21235

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/17.1/html/release_notes