Описание
ELSA-2022-9586: olcne security update (IMPORTANT)
olcne [1.4.6-2]
- Fix bug in gen-certs-helper script to change permission of node.key to allow opc user to copy over
- Update gen-certs-helper script to skip printing olcne_transfer_script execution
- Cleanup grpc connection when node not found and use substr method in case fqdn used for hostname
[1.4.6-1]
- Adress Istio CVE-2022-31045, CVE-2022-29225, CVE-2022-29224,CVE-2022-29226,CVE-2022-29228,CVE-2022-29227
[1.4.5-1]
- Address qemu CVE-2022-26353, CVE-2021-3748
[1.4.4-1]
- Excluded unnecessary directories from k8s backup files
[1.4.3-1]
- Update Istio to 1.13.2
[1.4.2-1]
- Added 1.4 extra images to registry-image-helper.sh script
[1.4.1-4]
- Ensure that the order of items in an upgraded config file is stable with respect to the original file
- Ensure that old olcnectl config files are upgraded
[1.4.1-3]
- Fixed a bug where specifying a port in the container-registry argument to the Kubernetes module would result in pods not being able to start.
[1.4.1-2]
- Allow loadbalancer to be configured regardless of security list mode
[1.4.1-1]
- Fix bug in initialising certs manager when environment name not mentioned
[1.4.0-3]
- Fix bug in fetching report for multi-environment
[1.4.0-2]
- Pause image is 3.4.1
[1.4.0-1]
- CSI plugin
- Reports feature
- Kubernetes-1.20.6 to Kubernetes-1.21.6 upgrade
- Istio-1.9.4 to Istio-1.11.4 upgrade
- Component upgrades
- Config file feature
[1.3.0-13]
- Fix iptables issue when running on OL7 host using OL8 image
[1.3.0-12]
- Address CVE's ISTIO-SECURITY-2021-003, ISTIO-SECURITY-2021-005, ISTIO-SECURITY-2021-006, ISTIO-SECURITY-2021-007
[1.3.0-11]
- Fixed yaml file to stop olcne-nginx and keepalived services at uninstall [Orabug: 32296282]
[1.3.0-10]
- Fixed missing double semicolon in registry image helper
[1.3.0-9] istio [1.13.5-1]
- Added Oracle specific files for 1.13.5-1
Обновленные пакеты
Oracle Linux 8
Oracle Linux x86_64
istio
1.13.5-1.el8
istio-istioctl
1.13.5-1.el8
olcne-agent
1.4.6-2.el8
olcne-api-server
1.4.6-2.el8
olcne-gluster-chart
1.4.6-2.el8
olcne-grafana-chart
1.4.6-2.el8
olcne-istio-chart
1.4.6-2.el8
olcne-nginx
1.4.6-2.el8
olcne-oci-csi-chart
1.4.6-2.el8
olcne-olm-chart
1.4.6-2.el8
olcne-prometheus-chart
1.4.6-2.el8
olcne-utils
1.4.6-2.el8
olcnectl
1.4.6-2.el8
Ссылки на источники
Связанные уязвимости
Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy also has a feature which can “hold” (prevent removal) upstream hosts obtained via service discovery until configured active health checking fails. If an attacker controls an upstream host and also controls service discovery of that host (via DNS, the EDS API, etc.), an attacker can crash Envoy by forcing removal of the host from service discovery, and then failing the gRPC health check request. This will crash Envoy via a null pointer dereference. Users are advised to upgrade to resolve this vulnerability. Users unable to upgrade may disable gRPC health checking and/or replace it with a different health checking type as a mitigation.
Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy also has a feature which can “hold” (prevent removal) upstream hosts obtained via service discovery until configured active health checking fails. If an attacker controls an upstream host and also controls service discovery of that host (via DNS, the EDS API, etc.), an attacker can crash Envoy by forcing removal of the host from service discovery, and then failing the gRPC health check request. This will crash Envoy via a null pointer dereference. Users are advised to upgrade to resolve this vulnerability. Users unable to upgrade may disable gRPC health checking and/or replace it with a different health checking type as a mitigation.