Moderate: RHSA: Submariner 0.13.3 - security updates and bug fixes

Topic

Submariner 0.13.3 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.6

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE links in the References section.

Description

Submariner enables direct networking between pods and services on different Kubernetes clusters that are either on-premises or in the cloud.

For more information about Submariner, see the Submariner open source community website at: https://submariner.io/.

This advisory contains bug fixes and enhancements to the Submariner container images.

Security fixes:

• CVE-2022-32149 golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags

Bugs addressed:

• Build Submariner 0.13.3 (ACM-2226)
• Verify Submariner with OCP 4.12 (ACM-2435)
• Submariner does not support cluster "kube-proxy ipvs mode" (ACM-2821)

Solution

For details on how to install Submariner, refer to:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/add-ons/add-ons-overview#submariner-deploy-console

and

https://submariner.io/getting-started/

Affected Products

• Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 8 x86_64

Fixes

• BZ - 2134010 - CVE-2022-32149 golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags
• ACM-2226 - [ACM 2.6.4] Build Submariner 0.13.3
• ACM-2435 - [ACM 2.6.4] Verify Submariner with OCP 4.12
• ACM-2821 - [Submariner] - 0.13.3 - Submariner does not support cluster "kube-proxy ipvs mode"

CVEs

• CVE-2021-46848
• CVE-2022-1304
• CVE-2022-2509
• CVE-2022-2601
• CVE-2022-3515
• CVE-2022-3775
• CVE-2022-3787
• CVE-2022-22624
• CVE-2022-22628
• CVE-2022-22629
• CVE-2022-22662
• CVE-2022-26700
• CVE-2022-26709
• CVE-2022-26710
• CVE-2022-26716
• CVE-2022-26717
• CVE-2022-26719
• CVE-2022-30293
• CVE-2022-30698
• CVE-2022-30699
• CVE-2022-32149
• CVE-2022-35737
• CVE-2022-40303
• CVE-2022-40304
• CVE-2022-42010
• CVE-2022-42011
• CVE-2022-42012
• CVE-2022-42898
• CVE-2022-43680

References

• https://access.redhat.com/security/updates/classification/#moderate