-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Migration Toolkit for Containers (MTC) 1.7.10 security and bug fix update Advisory ID: RHSA-2023:3624-01 Product: Red Hat Migration Toolkit Advisory URL: https://access.redhat.com/errata/RHSA-2023:3624 Issue date: 2023-06-15 CVE Names: CVE-2021-46848 CVE-2022-1304 CVE-2022-2795 CVE-2022-2880 CVE-2022-3627 CVE-2022-3970 CVE-2022-4304 CVE-2022-4450 CVE-2022-25147 CVE-2022-35737 CVE-2022-36227 CVE-2022-41715 CVE-2022-41717 CVE-2022-42898 CVE-2022-47629 CVE-2023-0215 CVE-2023-0286 CVE-2023-0361 CVE-2023-1999 CVE-2023-2491 CVE-2023-22490 CVE-2023-23946 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24540 CVE-2023-25652 CVE-2023-25815 CVE-2023-27535 CVE-2023-29007 ==================================================================== 1. Summary: The Migration Toolkit for Containers (MTC) 1.7.10 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Security Fix(es) from Bugzilla: * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540) * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) * golang: go/parser: Infinite loop in parsing (CVE-2023-24537) * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4. Bugs fixed (https://bugzilla.redhat.com/): 2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters 2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption 2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation 2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing 2196027 - CVE-2023-24540 golang: html/template: improper handling of JavaScript whitespace 2204461 - Adjust rsync options in DVM 2210565 - Direct migration completes with warnings, failing on DVM phase 2212528 - Rsync pod fails due to error in starting client-server protocol (code 5) 5. References: https://access.redhat.com/security/cve/CVE-2021-46848 https://access.redhat.com/security/cve/CVE-2022-1304 https://access.redhat.com/security/cve/CVE-2022-2795 https://access.redhat.com/security/cve/CVE-2022-2880 https://access.redhat.com/security/cve/CVE-2022-3627 https://access.redhat.com/security/cve/CVE-2022-3970 https://access.redhat.com/security/cve/CVE-2022-4304 https://access.redhat.com/security/cve/CVE-2022-4450 https://access.redhat.com/security/cve/CVE-2022-25147 https://access.redhat.com/security/cve/CVE-2022-35737 https://access.redhat.com/security/cve/CVE-2022-36227 https://access.redhat.com/security/cve/CVE-2022-41715 https://access.redhat.com/security/cve/CVE-2022-41717 https://access.redhat.com/security/cve/CVE-2022-42898 https://access.redhat.com/security/cve/CVE-2022-47629 https://access.redhat.com/security/cve/CVE-2023-0215 https://access.redhat.com/security/cve/CVE-2023-0286 https://access.redhat.com/security/cve/CVE-2023-0361 https://access.redhat.com/security/cve/CVE-2023-1999 https://access.redhat.com/security/cve/CVE-2023-2491 https://access.redhat.com/security/cve/CVE-2023-22490 https://access.redhat.com/security/cve/CVE-2023-23946 https://access.redhat.com/security/cve/CVE-2023-24534 https://access.redhat.com/security/cve/CVE-2023-24536 https://access.redhat.com/security/cve/CVE-2023-24537 https://access.redhat.com/security/cve/CVE-2023-24538 https://access.redhat.com/security/cve/CVE-2023-24540 https://access.redhat.com/security/cve/CVE-2023-25652 https://access.redhat.com/security/cve/CVE-2023-25815 https://access.redhat.com/security/cve/CVE-2023-27535 https://access.redhat.com/security/cve/CVE-2023-29007 https://access.redhat.com/security/updates/classification/#important 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZIsIe9zjgjWX9erEAQgA0A//bsZOIKpOdr02qQ/OwtMcoothwy9wozWq xCCscfKssH+gX4xBIPj6QEgD8db7eVfcbPzihANAoBkR1JcFJdQ2Xa2rVszccexn a0cZKRPwcMYCz2s5JDmFf6uJ9En5pRyFoMo8ST5diKEP1Kal7jfZvMtUE7OxT98Z +8SzwXrKk8G8mmxP9h2/RQRYs9WKkS3FF8x5eH+66+SvtImkTfbKBWRE7+lgxeLf WxXeUvFaItWHyzJDG8fzyh8vaHrelCrNdUuz1rOtXXO8lMc4A2FeW9mFVqVf9YSe qxZtLv9jKb9KGtne4/LKnNGxeGg92+BCFQhgTZ6Po3ORCXpNCv+Yv79a1pXwAKZy ENybQonccBf2TXA5HFEfvHot4vovzEIak6Cy3WVAMU7y5tzxdyPlU33qzTL38Ihx Eb0gbaVUE8lyXsWDj/1PugYGvMQ9PjNk2SrHGsIuFLi+34tvYVRHGcJZ9SfeTngR j38TfxS9WDd+wLO/ZDIPRhVuLiAkqqV2urrvpqc177t00vrBHnB4TnKSVCK93xyJ VPJMVCoGiTx1JNMd0nTrLErMPe/OWzqpA/PZEcCmzzsHenck1tSgYlxZiwfFIlXU gEIMQ8A/A9UP4OoVG+ob2tyB/dgg/CicZKQoD/KJ6J2aRXqpFT2kSqhGQ37pplOe ROr4a9CDa68=J4k1 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce