-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Service Interconnect 1.4 Release security update
Advisory ID:       RHSA-2023:4003-01
Product:           Red Hat Service Interconnect
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4003
Issue date:        2023-07-10
CVE Names:         CVE-2022-2879 CVE-2022-2880 CVE-2022-28327 
                   CVE-2022-41715 CVE-2022-41723 CVE-2022-41724 
                   CVE-2022-41725 CVE-2023-24534 CVE-2023-24536 
                   CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 
                   CVE-2023-29400 
=====================================================================

1. Summary:

This is release 1.4 of the rpms for Red Hat Service Interconnect. Red Hat
Service Interconnect 1.4 introduces a service network, linking TCP and HTTP
services across the hybrid cloud.
A service network enables communication between services running in
different network locations or sites. It allows geographically distributed
services to connect as if they were all running in the same site.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

8Base-Service-Interconnect-1 - noarch, x86_64
9Base-Service-Interconnect-1 - noarch, x86_64

3. Description:

As a Kubernetes user, I cannot connect easily connect services from one
cluster with services on another cluster. Red Hat Application Interconnect
enables me to create a service network and it allows geographically
distributed services to connect as if they were all running in the same
site.

Security Fix(es):

* golang: archive/tar: unbounded memory consumption when reading headers
(CVE-2022-2879)

* golang: net/http/httputil: ReverseProxy should not forward unparseable
query parameters (CVE-2022-2880)

* golang: crypto/elliptic: panic caused by oversized scalar
(CVE-2022-28327)

* golang: regexp/syntax: limit memory used by parsing regexps
(CVE-2022-41715)

* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK
decoding (CVE-2022-41723)

* golang: crypto/tls: large handshake records may cause panics
(CVE-2022-41724)

* golang: net/http, mime/multipart: denial of service from excessive
resource consumption (CVE-2022-41725)

* golang: net/http, net/textproto: denial of service from excessive memory
allocation (CVE-2023-24534)

* golang: net/http, net/textproto, mime/multipart: denial of service from
excessive resource consumption (CVE-2023-24536)

* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

* golang: html/template: backticks not treated as string delimiters
(CVE-2023-24538)

* golang: html/template: improper sanitization of CSS values
(CVE-2023-24539)

* golang: html/template: improper handling of empty HTML attributes
(CVE-2023-29400)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2077689 - CVE-2022-28327 golang: crypto/elliptic: panic caused by oversized scalar
2132867 - CVE-2022-2879 golang: archive/tar: unbounded memory consumption when reading headers
2132868 - CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
2132872 - CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding
2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption
2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics
2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters
2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation
2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing
2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values
2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes

6. Package List:

8Base-Service-Interconnect-1:

Source:
libwebsockets-4.3.1-1.el8ai.src.rpm
qpid-proton-0.37.0-2.el8ai.src.rpm
skupper-cli-1.4.1-2.el8.src.rpm
skupper-router-2.4.1-2.el8.src.rpm

noarch:
skupper-router-common-2.4.1-2.el8.noarch.rpm
skupper-router-docs-2.4.1-2.el8.noarch.rpm
skupper-router-tools-2.4.1-2.el8.noarch.rpm

x86_64:
libwebsockets-4.3.1-1.el8ai.x86_64.rpm
libwebsockets-debuginfo-4.3.1-1.el8ai.x86_64.rpm
libwebsockets-debugsource-4.3.1-1.el8ai.x86_64.rpm
libwebsockets-devel-4.3.1-1.el8ai.x86_64.rpm
python3-qpid-proton-0.37.0-2.el8ai.x86_64.rpm
python3-qpid-proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-c-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-c-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-c-devel-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-cpp-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm
qpid-proton-debugsource-0.37.0-2.el8ai.x86_64.rpm
rubygem-qpid_proton-debuginfo-0.37.0-2.el8ai.x86_64.rpm
skupper-cli-1.4.1-2.el8.x86_64.rpm
skupper-router-2.4.1-2.el8.x86_64.rpm
skupper-router-debuginfo-2.4.1-2.el8.x86_64.rpm
skupper-router-debugsource-2.4.1-2.el8.x86_64.rpm

9Base-Service-Interconnect-1:

Source:
jsoncpp-1.9.4-3.el9.src.rpm
libwebsockets-4.3.1-1.el9ai.src.rpm
qpid-proton-0.37.0-2.el9ai.src.rpm
skupper-cli-1.4.1-2.el9.src.rpm
skupper-router-2.4.1-2.el9.src.rpm

noarch:
skupper-router-common-2.4.1-2.el9.noarch.rpm
skupper-router-docs-2.4.1-2.el9.noarch.rpm
skupper-router-tools-2.4.1-2.el9.noarch.rpm

x86_64:
jsoncpp-1.9.4-3.el9.x86_64.rpm
jsoncpp-debuginfo-1.9.4-3.el9.x86_64.rpm
jsoncpp-debugsource-1.9.4-3.el9.x86_64.rpm
jsoncpp-devel-1.9.4-3.el9.x86_64.rpm
libwebsockets-4.3.1-1.el9ai.x86_64.rpm
libwebsockets-debuginfo-4.3.1-1.el9ai.x86_64.rpm
libwebsockets-debugsource-4.3.1-1.el9ai.x86_64.rpm
libwebsockets-devel-4.3.1-1.el9ai.x86_64.rpm
python3-qpid-proton-0.37.0-2.el9ai.x86_64.rpm
python3-qpid-proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-c-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-c-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-c-devel-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-cpp-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-cpp-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-cpp-devel-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm
qpid-proton-debugsource-0.37.0-2.el9ai.x86_64.rpm
rubygem-qpid_proton-debuginfo-0.37.0-2.el9ai.x86_64.rpm
skupper-cli-1.4.1-2.el9.x86_64.rpm
skupper-router-2.4.1-2.el9.x86_64.rpm
skupper-router-debuginfo-2.4.1-2.el9.x86_64.rpm
skupper-router-debugsource-2.4.1-2.el9.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-2879
https://access.redhat.com/security/cve/CVE-2022-2880
https://access.redhat.com/security/cve/CVE-2022-28327
https://access.redhat.com/security/cve/CVE-2022-41715
https://access.redhat.com/security/cve/CVE-2022-41723
https://access.redhat.com/security/cve/CVE-2022-41724
https://access.redhat.com/security/cve/CVE-2022-41725
https://access.redhat.com/security/cve/CVE-2023-24534
https://access.redhat.com/security/cve/CVE-2023-24536
https://access.redhat.com/security/cve/CVE-2023-24537
https://access.redhat.com/security/cve/CVE-2023-24538
https://access.redhat.com/security/cve/CVE-2023-24539
https://access.redhat.com/security/cve/CVE-2023-29400
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_service_interconnect

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJkrCiuAAoJENzjgjWX9erEM2gP/2vUJQvf383OISO9rO36AQ/J
CpvJsVopoqPsOM9efR4Wlj272mPOGAn2dih6ZBqEX2nvCwrP3yKExqhy1b6k+36M
dXBG2ZAp7bLKbfp4Q+FPSBcHx/TRnS9cWkQ5O7bNroZKAxA6eqv73peiGAWf3B+L
8GHRrZkniv0X+oiWTASrziEfjuUta4GhhIQxnDMt2vAj62zN+PNTULtgOkG0o8E3
7mnL5aJ48JgaPk8SiZNlozE6gVPpUYFCkzM9IIq+LrLLS0hXSiJGv6vRB1NTMmgy
5YrXqbo/xKsZtFGJgXb3OPO+tRBvisDenkSIZ9XCeKWM/duuSXPfjctsVDgVtOkt
gK6sAy9D3Tug6oXNIUZpKh0/ndyxwTjXG3GEHlQOdvuCH7OpIhkBKiDFxKbQHNqj
1tf3PmKDkArTRC7DTAD3Q+pYuDJgu5/PMBZLvp4Ok7TXODPlCKUlp+PC/CLcBi4w
kmJIn6n0G05JcnBCbSV0pHY+z/QGfNQwB4AL5Pg9AAq4vYZis0nlg8OBJ8Xyih00
tzajFvLXPbJ4DJ+wcopzQFB/HJ/m/F4uH9z9+b73QigiomCs8MWLXRvfDO2GkOkK
KkiPj9RWrcXBuCOwPXVVJi9/bwGPT7tufXWei+X1WwBqf537Tkg9r001EOvGtzSc
LJnVw0+s1xYM+2cYsVa5
=OCZA
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce