-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Migration Toolkit for Containers (MTC) 1.7.7 security and bug fix update
Advisory ID:       RHSA-2023:0693-01
Product:           Red Hat Migration Toolkit
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:0693
Issue date:        2023-02-09
CVE Names:         CVE-2021-4235 CVE-2021-43138 CVE-2021-46848 
                   CVE-2022-2056 CVE-2022-2057 CVE-2022-2058 
                   CVE-2022-2519 CVE-2022-2520 CVE-2022-2521 
                   CVE-2022-2867 CVE-2022-2868 CVE-2022-2869 
                   CVE-2022-2879 CVE-2022-2880 CVE-2022-2953 
                   CVE-2022-2995 CVE-2022-3162 CVE-2022-3172 
                   CVE-2022-3259 CVE-2022-3466 CVE-2022-3821 
                   CVE-2022-4883 CVE-2022-27664 CVE-2022-30631 
                   CVE-2022-32148 CVE-2022-32149 CVE-2022-32189 
                   CVE-2022-32190 CVE-2022-35737 CVE-2022-40303 
                   CVE-2022-40304 CVE-2022-41715 CVE-2022-41717 
                   CVE-2022-42010 CVE-2022-42011 CVE-2022-42012 
                   CVE-2022-43680 CVE-2022-44617 CVE-2022-46285 
=====================================================================

1. Summary:

The Migration Toolkit for Containers (MTC) 1.7.7 is now available.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

The Migration Toolkit for Containers (MTC) enables you to migrate
Kubernetes resources, persistent volume data, and internal container images
between OpenShift Container Platform clusters, using the MTC web console or
the Kubernetes API.

Security Fix(es) from Bugzilla:

* async: Prototype Pollution in async (CVE-2021-43138)

* golang: archive/tar: unbounded memory consumption when reading headers
(CVE-2022-2879)

* golang: net/http/httputil: ReverseProxy should not forward unparseable
query parameters (CVE-2022-2880)

* golang: net/http: handle server errors after sending GOAWAY
(CVE-2022-27664)

* golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time
to parse complex tags (CVE-2022-32149)

* golang: net/url: JoinPath does not strip relative path components in all
circumstances (CVE-2022-32190)

* golang: regexp/syntax: limit memory used by parsing regexps
(CVE-2022-41715)

* golang: net/http: An attacker can cause excessive memory growth in a Go
server accepting HTTP/2 requests (CVE-2022-41717)

* golang: math/big: decoding big.Float and big.Rat types can panic if the
encoded message is too short, potentially allowing a denial of service
(CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

3. Solution:

For details on how to install and use MTC, refer to:

https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html

4. Bugs fixed (https://bugzilla.redhat.com/):

2113814 - CVE-2022-32189 golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service
2124668 - CVE-2022-32190 golang: net/url: JoinPath does not strip relative path components in all circumstances
2124669 - CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
2126276 - CVE-2021-43138 async: Prototype Pollution in async
2132867 - CVE-2022-2879 golang: archive/tar: unbounded memory consumption when reading headers
2132868 - CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
2132872 - CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
2134010 - CVE-2022-32149 golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags
2160662 - Velero pod crashing leading to migrations being stuck during Backup Phase
2161274 - CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests

5. JIRA issues fixed (https://issues.jboss.org/):

MIG-1275 - Update base image for hook-runner so kubernetes.core 2.3.2 or newer is present
MIG-1281 - Allow DVM to be configured with alternative network strategies, more than an openshift route.

6. References:

https://access.redhat.com/security/cve/CVE-2021-4235
https://access.redhat.com/security/cve/CVE-2021-43138
https://access.redhat.com/security/cve/CVE-2021-46848
https://access.redhat.com/security/cve/CVE-2022-2056
https://access.redhat.com/security/cve/CVE-2022-2057
https://access.redhat.com/security/cve/CVE-2022-2058
https://access.redhat.com/security/cve/CVE-2022-2519
https://access.redhat.com/security/cve/CVE-2022-2520
https://access.redhat.com/security/cve/CVE-2022-2521
https://access.redhat.com/security/cve/CVE-2022-2867
https://access.redhat.com/security/cve/CVE-2022-2868
https://access.redhat.com/security/cve/CVE-2022-2869
https://access.redhat.com/security/cve/CVE-2022-2879
https://access.redhat.com/security/cve/CVE-2022-2880
https://access.redhat.com/security/cve/CVE-2022-2953
https://access.redhat.com/security/cve/CVE-2022-2995
https://access.redhat.com/security/cve/CVE-2022-3162
https://access.redhat.com/security/cve/CVE-2022-3172
https://access.redhat.com/security/cve/CVE-2022-3259
https://access.redhat.com/security/cve/CVE-2022-3466
https://access.redhat.com/security/cve/CVE-2022-3821
https://access.redhat.com/security/cve/CVE-2022-4883
https://access.redhat.com/security/cve/CVE-2022-27664
https://access.redhat.com/security/cve/CVE-2022-30631
https://access.redhat.com/security/cve/CVE-2022-32148
https://access.redhat.com/security/cve/CVE-2022-32149
https://access.redhat.com/security/cve/CVE-2022-32189
https://access.redhat.com/security/cve/CVE-2022-32190
https://access.redhat.com/security/cve/CVE-2022-35737
https://access.redhat.com/security/cve/CVE-2022-40303
https://access.redhat.com/security/cve/CVE-2022-40304
https://access.redhat.com/security/cve/CVE-2022-41715
https://access.redhat.com/security/cve/CVE-2022-41717
https://access.redhat.com/security/cve/CVE-2022-42010
https://access.redhat.com/security/cve/CVE-2022-42011
https://access.redhat.com/security/cve/CVE-2022-42012
https://access.redhat.com/security/cve/CVE-2022-43680
https://access.redhat.com/security/cve/CVE-2022-44617
https://access.redhat.com/security/cve/CVE-2022-46285
https://access.redhat.com/security/updates/classification/#moderate

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY+RnvtzjgjWX9erEAQj1Uw//Sajfr2eFvjS/4S4vFPjwT4h2vmhZx41v
khxvUYsIiISMIdqGFyeHwGjJIVZvxLeNJFRgFwg7V/x3pK3cFf7mgFLLIFa+jZOy
emzSTft3XWAgdAVw8PkrohPTsg49jJHklXBrekoH1HqKUQVbZxpKBjo5iGHbk+K3
cpUF7ZJoPUa9bRmqE2DIOyQQyKmqivCh61wDQTZjR6S2xOeo0Y666pVl3cOcHpcp
TVGsnO+o3qvqO7PezE6L1znbifO0jL6dsWFHysAKjYl0MR0hFjeloJVRq4QME49r
qeDGGITJXfIAQzbo2CzyaP5Ifmre0O1VIAX5QyE3xhzgdn1JUeDBi3kOH1RLGXvq
oYlkvVhV3xPBH9YK1hmTZalvy79tf9zi24sdk1/U+W/mZz/ZIKqPi+EyB3zio6Tm
buYmultPogNVUWdRGuXxCCr2Alfw400dfmAFXWQ7JWX6XrxCwqz4YsfpZpslFMjT
hYIH+jzVDbA3iL6nOJ3U0JnGo68KlcsnBfbGVkUWrf55O5bJp2N1Yf7KHZTcYonx
QnQID1Xhwjye1pjV7/dCUjBjnXDcVcbfnxExK7AFHih8DBZc9DN3JP/cM1mjK6ab
9hpMRo0NyfP1DNkpCTOFRmxmeiSvZZlxs1STin6XAbIKnIZdFGMWm7cDQgphXIVt
Q40G6CG91Uo=
=8Igd
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce