Moderate: RHSA: Submariner 0.13 - security and enhancement update

Topic

Submariner 0.13 packages that fix security issues and bugs, as well as adds various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.6.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Submariner enables direct networking between pods and services on different Kubernetes clusters that are either on-premises or in the cloud.

For more information about Submariner, see the Submariner open source community website at: https://submariner.io/.

This advisory contains bug fixes and enhancements to the Submariner container images.

Security fixes:

• CVE-2021-38561: golang: out-of-bounds read in golang.org/x/text/language leads to DoS
• CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
• CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
• CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
• CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
• CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
• CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
• CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal
• CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode
• CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
• CVE-2022-30629 golang: crypto/tls: session tickets lack random ticket_age_add

Solution

For details on how to install Submariner, refer to:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/submariner#submariner-deploy-console

and

https://submariner.io/getting-started/

Affected Products

• Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 8 x86_64

Fixes

• BZ - 2092793 - CVE-2022-30629 golang: crypto/tls: session tickets lack random ticket_age_add
• BZ - 2100495 - CVE-2021-38561 golang: out-of-bounds read in golang.org/x/text/language leads to DoS
• BZ - 2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
• BZ - 2107371 - CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
• BZ - 2107374 - CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
• BZ - 2107376 - CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
• BZ - 2107383 - CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
• BZ - 2107386 - CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
• BZ - 2107388 - CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode
• BZ - 2107390 - CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
• BZ - 2107392 - CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal

CVEs

• CVE-2021-38561
• CVE-2021-40528
• CVE-2022-1292
• CVE-2022-1586
• CVE-2022-1705
• CVE-2022-1962
• CVE-2022-2068
• CVE-2022-2097
• CVE-2022-2526
• CVE-2022-25313
• CVE-2022-25314
• CVE-2022-28131
• CVE-2022-29824
• CVE-2022-30629
• CVE-2022-30630
• CVE-2022-30631
• CVE-2022-30632
• CVE-2022-30633
• CVE-2022-30635
• CVE-2022-32148
• CVE-2022-32206
• CVE-2022-32208

References

• https://access.redhat.com/security/updates/classification/#moderate