-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: Red Hat Advanced Cluster Management 2.7.7 security and bug fix updates
Advisory ID:       RHSA-2023:4654-01
Product:           Red Hat ACM
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4654
Issue date:        2023-08-15
CVE Names:         CVE-2020-24736 CVE-2023-1667 CVE-2023-2283 
                   CVE-2023-2602 CVE-2023-2603 CVE-2023-3089 
                   CVE-2023-27536 CVE-2023-28321 CVE-2023-28484 
                   CVE-2023-29469 CVE-2023-32681 CVE-2023-34969 
                   CVE-2023-37903 CVE-2023-38408 
=====================================================================

1. Summary:

Red Hat Advanced Cluster Management for Kubernetes 2.7.7 General
Availability release images, which provide security updates and fix bugs.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE links in the References section.

2. Description:

Red Hat Advanced Cluster Management for Kubernetes 2.7.7 images

Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which fix several bugs. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.7/html/release_notes/

Security fix(es):
* CVE-2023-3089 - openshift: OCP & FIPS mode
* CVE-2023-37903 - vm2: custom inspect function allows attackers to escape
the sandbox and run arbitrary code

3. Solution:

For information and instructions for these updates, see the following
article: https://access.redhat.com/solutions/7022540.

For additional information about Red Hat Advanced Cluster Management for
Kubernetes, see the following
documentation, which will be updated shortly for this release, for
important
instructions on installing this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.7/html-single/install/index#installing

4. Bugs fixed (https://bugzilla.redhat.com/):

2212085 - CVE-2023-3089 openshift: OCP & FIPS mode
2224969 - CVE-2023-37903 vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code

5. References:

https://access.redhat.com/security/cve/CVE-2020-24736
https://access.redhat.com/security/cve/CVE-2023-1667
https://access.redhat.com/security/cve/CVE-2023-2283
https://access.redhat.com/security/cve/CVE-2023-2602
https://access.redhat.com/security/cve/CVE-2023-2603
https://access.redhat.com/security/cve/CVE-2023-3089
https://access.redhat.com/security/cve/CVE-2023-27536
https://access.redhat.com/security/cve/CVE-2023-28321
https://access.redhat.com/security/cve/CVE-2023-28484
https://access.redhat.com/security/cve/CVE-2023-29469
https://access.redhat.com/security/cve/CVE-2023-32681
https://access.redhat.com/security/cve/CVE-2023-34969
https://access.redhat.com/security/cve/CVE-2023-37903
https://access.redhat.com/security/cve/CVE-2023-38408
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/RHSB-2023-001

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJk293zAAoJENzjgjWX9erEN+YP/0pQnc2y8XN3hfk2S4Eu7cr4
xHIZMULvu+Qqx2qUFXNOA95mbSGt5+11zmSmXpqgzSKvx6fGPg3pwPOeU9k8umMn
phzqhC5BJKAb4k70kwEmMautU8KVl1/KjcPYSzj7IxZNYQqFo5SKMVrhC/UHQOqU
FEX6oIIyuD6hnVyG511UjIF6iaijiPE7kR42C9TAeyVZp1MmlMbAbCWfJDDwk5md
w6KF9NzpYSHy5uiU9vihY96XQFg4k3lbCpZNlfBJVTEWciJqOl0YgrRuwlTCZ2g9
F8sniLMW2yjgTnBfoLcUsbrjA/rfCjEGh3humLmyEhWq2Q3x8AItl58Kpa6ADHeE
XGOJRzT1p8yvximyh1p+OtYzEdtD1bSsj0vEPARFSLOZ8Kh1zzFMxikrr14VJqrH
Fcq45j7+p0eKLEzacEP0yxzl91DU521mLcA9UMU+DkgMhWIz7DFn6w8ewnt5hnCv
rPMnb/Htfkm/Sv86MY7uMUTrvU3kFgUz9TE7binNpEowLFE5LLr9+o/wCHXD9F06
1xrGKMQNY/9pXMw6i4YkciI+jxloTLWluo4IAuDGxoTckDrK8o1sk3ImAk3bbeUU
QdOe4TX9y+Xy69GtwFinc6j3utGGKUautvefTMpR16ToYvzXtw3RPT/DbitMjvef
yO8QfH1zWqR6IS+OLAeS
=NiGM
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce