Home / mailings [RHSA-2023:1894-01] Critical: Multicluster Engine for Kubernetes 2.1 hotfix security update for console
Posted on 25 April 2023
RedHat===================================================================== Red Hat Security Advisory
Synopsis: Critical: Multicluster Engine for Kubernetes 2.1 hotfix security update for console
Advisory ID: RHSA-2023:1894-01
Product: multicluster engine for Kubernetes
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1894
Issue date: 2023-04-20
CVE Names: CVE-2023-29017 CVE-2023-29199 CVE-2023-30547
=====================================================================
1. Summary:
Multicluster Engine for Kubernetes 2.1 hotfix security update for console
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Description:
Security Fix(es)
* CVE-2023-29017 vm2: Sandbox Escape
* CVE-2023-29199 vm2: Sandbox Escape
* CVE-2023-30547 vm2: Sandbox Escape when exception sanitization
3. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied, and that you are running
Multicluster Engine for Kubernetes version 2.1.5.
See https://access.redhat.com/solutions/7007647 for instructions on how to
apply this hotfix, as well as for information about when the hotfix has
been
superseded by a permanent fix and should be removed.
Important: This hotfix is a temporary fix that will be supported until 30
days after the date when the next patch release of the product is released.
After the 30-day period ends, you must either update to the latest patch
release and remove this hotfix to continue receiving security updates and
maintain support or upgrade to a newer feature release of the product.
4. Bugs fixed (https://bugzilla.redhat.com/):
2185374 - CVE-2023-29017 vm2: sandbox escape
2187409 - CVE-2023-29199 vm2: Sandbox Escape
2187608 - CVE-2023-30547 vm2: Sandbox Escape when exception sanitization
5. References:
https://access.redhat.com/security/cve/CVE-2023-29017
https://access.redhat.com/security/cve/CVE-2023-29199
https://access.redhat.com/security/cve/CVE-2023-30547
https://access.redhat.com/security/updates/classification/#critical
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
