Low: Release of OpenShift Serverless Client kn 1.22.0

Related Vulnerabilities: CVE-2021-41771   CVE-2021-41772  

Synopsis

Low: Release of OpenShift Serverless Client kn 1.22.0

Type/Severity

Security Advisory: Low

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Release of OpenShift Serverless Client kn 1.22.0

Red Hat Product Security has rated this update as having a security impact of
Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Description

Red Hat OpenShift Serverless Client kn 1.22.0 provides a CLI to interact with Red Hat OpenShift Serverless 1.22.0. The kn CLI is delivered as an RPM package for installation on RHEL platforms, and as binaries for non-Linux platforms.

Security Fix(es):

  • golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)
  • golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Solution

See the Red Hat OpenShift Container Platform 4.6 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index

Affected Products

  • Red Hat Openshift Serverless 1 x86_64
  • Red Hat OpenShift Serverless for IBM Power, little endian 1 ppc64le
  • Red Hat OpenShift Serverless for IBM Z and LinuxONE 1 s390x

Fixes

  • BZ - 2020725 - CVE-2021-41771 golang: debug/macho: invalid dynamic symbol table command can cause panic
  • BZ - 2020736 - CVE-2021-41772 golang: archive/zip: Reader.Open panics on empty string