-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: Red Hat Advanced Cluster Management 2.6.7 security and bug fix updates
Advisory ID:       RHSA-2023:4980-01
Product:           Red Hat ACM
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4980
Issue date:        2023-09-05
CVE Names:         CVE-2020-24736 CVE-2023-1667 CVE-2023-2283 
                   CVE-2023-2602 CVE-2023-2603 CVE-2023-3089 
                   CVE-2023-3899 CVE-2023-24329 CVE-2023-27536 
                   CVE-2023-28321 CVE-2023-28484 CVE-2023-29469 
                   CVE-2023-32681 CVE-2023-34969 CVE-2023-37466 
                   CVE-2023-37903 
=====================================================================

1. Summary:

Red Hat Advanced Cluster Management for Kubernetes 2.6.7 General
Availability release images, which provide security updates and fix bugs.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE links in the References section.

2. Description:

Red Hat Advanced Cluster Management for Kubernetes 2.6.7 images

Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which fix several bugs. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/release_notes/

Security fix(es):
* CVE-2023-3089 - openshift: OCP & FIPS mode
* CVE-2023-37903 - vm2: custom inspect function allows attackers to escape
the sandbox and run arbitrary code
* CVE-2023-37466 - vm2: Promise handler sanitization can be bypassed
allowing
attackers to escape the sandbox and run arbitrary code

3. Solution:

For information and instructions for these updates, see the following
article: https://access.redhat.com/solutions/7022540.

For Red Hat Advanced Cluster Management for Kubernetes, see the following
documentation for details on how to install the images:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/install/installing#installing-while-connected-online

4. Bugs fixed (https://bugzilla.redhat.com/):

2212085 - CVE-2023-3089 openshift: OCP & FIPS mode
2224969 - CVE-2023-37903 vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code
2232376 - CVE-2023-37466 vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code

5. References:

https://access.redhat.com/security/cve/CVE-2020-24736
https://access.redhat.com/security/cve/CVE-2023-1667
https://access.redhat.com/security/cve/CVE-2023-2283
https://access.redhat.com/security/cve/CVE-2023-2602
https://access.redhat.com/security/cve/CVE-2023-2603
https://access.redhat.com/security/cve/CVE-2023-3089
https://access.redhat.com/security/cve/CVE-2023-3899
https://access.redhat.com/security/cve/CVE-2023-24329
https://access.redhat.com/security/cve/CVE-2023-27536
https://access.redhat.com/security/cve/CVE-2023-28321
https://access.redhat.com/security/cve/CVE-2023-28484
https://access.redhat.com/security/cve/CVE-2023-29469
https://access.redhat.com/security/cve/CVE-2023-32681
https://access.redhat.com/security/cve/CVE-2023-34969
https://access.redhat.com/security/cve/CVE-2023-37466
https://access.redhat.com/security/cve/CVE-2023-37903
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/RHSB-2023-001

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJk93zJAAoJENzjgjWX9erEbuAP/3XdGWyp6VAaa41pb7YSs6TD
lN4+/Zwg1ZHYWeeJpuEcQxguDXikYQFagO8iT/T5hZr8qwn5R5JqkZKUcLBjxSDP
YggOnlXM01AZDbZZyECs+fAyiBCvlFlS6rBlBal+DjpkXxiTSSmWPYC4UnaJGBDC
ljPtQ++mEKGjac2i5YXh6HQv2AcZGk2H/7lFsYXzNY795VlI8dKBjkf3+wA/Cehv
6S6r1BTiM/FffUdoZNe+cco9+xk5sJKEBUkll3VVCvNnU7xYP85A0w0xECoJzhq9
cPaZ5hvJcJUFTyvJO9Rxy7erLeSHoHPY/4xiyD+KNkbRiJbIgKmiWwtaNERl9hdD
Ksb6LGETZSlsuO/vb+eluMLtxnPwSXXZZifCL/SKKxFpMf27NrQr45C5wE2BSO24
G2YAuBnwM+5nGRrggnX2XiZcqA7HwyOF5O2r9EMhCODXJPvkVHgV+0aezzI89w6Y
+hOQ99HfvEoWvXiyn0NFgyfRlifYEx/klOTpxVoG16CwuY9v52S7vpGCCKomG6Yu
kRG8HHqvyuEzwKYCI7nw3Cv3jBubWWJeHh4W7a8hI/NkDJXqgkZssEv+lxwQ3iZY
i/COReg1QMczxBmgbOU9pQtkY4ntRVcY/4S8UoaCacg3KUsKJ8238JERsOx7ti1X
HMZK2IxkiVau0YNz+MVO
=6z7Z
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce