RHSA-2021:4618HighCVSS 9.8

Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4 images and security updates

Published
November 11, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (15)

CVE-2021-32626 →CVE-2021-32627 →CVE-2021-32628 →CVE-2021-32804 →CVE-2021-41099 →CVE-2021-3749 →CVE-2021-32675 →CVE-2021-32690 →CVE-2021-32803 →CVE-2021-3711 →CVE-2021-32672 →CVE-2021-32687 →CVE-2021-33623 →CVE-2021-3712 →CVE-2021-23017 →

📋 Description

CVE-2021-3711 — openssl: SM2 Decryption Buffer Overflow CVE-2021-3712 — openssl: Read buffer overruns processing ASN.1 strings CVE-2021-3749 — nodejs-axios: Regular expression denial of service in trim function CVE-2021-23017 — nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name CVE-2021-32626 — redis: Lua scripts can overflow the heap-based Lua stack CVE-2021-32627 — redis: Integer overflow issue with Streams CVE-2021-32628 — redis: Integer overflow bug in the ziplist data structure CVE-2021-32672 — redis: Out of bounds read in lua debugger protocol parser CVE-2021-32675 — redis: Denial of service via Redis Standard Protocol (RESP) request CVE-2021-32687 — redis: Integer overflow issue with intsets CVE-2021-32690 — helm: information disclosure vulnerability CVE-2021-32803 — nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite CVE-2021-32804 — nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite CVE-2021-33623 — nodejs-trim-newlines: ReDoS in .end() method CVE-2021-41099 — redis: Integer overflow issue with strings

🎯 Affected products200

  • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:496954af2d9c5262516cb87c8390f80791826d4d23a7392f06c248f0cb99afe2_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:ef85ee276e8c2f44eea536a45971eb708614cc047111ef1061401d4b9760168c_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:fd564325005bdde50413b581cfa0ac58e37bce64ccebebac0b70651a06a5a183_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:0a5eeb0b6a5b990fa2ac7ba8ce4d44084f2a1f93265249ce8f3b8cd9dff78e70_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:acedcbb6483e2b6b51f69900de4f582f48a486114ef6ecaede82f1f549fb4ebf_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:f2dd5096ad17d494211d3b8f93c423ea35d3041f0325fa2e26ff60897c95df99_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:17f71990d653d75ec9b55a3044b898068300795e685baac2e6a9db59100c95c9_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:22b9c240d63133031d2b869b57673abf63cb6f20c535a2c5e7f6fa3e635d32e4_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:234ff9f1dc4db52a2722a4b7779b547ddaf6b8a611252f2f1d42648d49879be8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/agent-service-rhel8@sha256:328f595cdf69ac14e03cd14ad4120cca0c460a57f86ee9bac5cd4e7a396452a4_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/agent-service-rhel8@sha256:acd4c5342ce6c159c0d9a05f4dae29d9ef4d319ba395f0e56cd09f368ca76ca2_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/agent-service-rhel8@sha256:cf8aa0ce33abb7d0cb7304d4719ddd5cd36135efff39135b29822c7002c3c0e8_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/application-ui-rhel8@sha256:1cbdb0563a9435a6a1ef958a35bbe4000c179d49ee3dca6e3798789bce9eec2f_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/application-ui-rhel8@sha256:2cfaa4e8d034f0c9ece63e2e82811bf91bef8d6398d81763f1a39547e9bf36e0_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/application-ui-rhel8@sha256:44b3cf1b1175c5338b5e84e0f11d2cdd3563273519774252ebc97db24d161c6e_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-image-service-rhel8@sha256:2fda600b1bda57b551ea7a49a7c1188e250ee5fbb062046778ba36d629fc8ff0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-image-service-rhel8@sha256:b5fb0dbece2bb3f022b4c2d84297c9e48f8281b3cea02b46c8da7d66c87d3042_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-agent-rhel8@sha256:ce03294937f56f7a7bb0cea24126ad4f715eb147359d32ab1470c666cb31a5be_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-reporter-rhel8@sha256:4e56dd6660914111e9034f126043668dc78d833f9066d43f9d287fd9d38a7a56_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-reporter-rhel8@sha256:8e2ad59d93d64b81064d2901b162961d44400ca53970ffa5c4118405af507db9_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-rhel8@sha256:2a5f8abcadf5dacd303392372c2bdaae838e7650ca23f015f43c96f0960298e4_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/assisted-installer-rhel8@sha256:8e719e41b950700f894d912227e0a1005cf0370fe587b042b185841227f77514_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:0b05bdb6de7165855c4edf0e93c575647df52acff97861978a51809cb9a95f1d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:2052786ac778bdefa85a1de0089c5b4e5173da2d250f9ee2325d2c424893e05b_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:5b8fa00c0d0912b776700cecc33e10df159d8a8963f478a5159cdd6a15582446_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-backup-rhel8-operator@sha256:03a6b0a7eb0067654344dde605219062496c7e174c8b7f16428c9df3b2ce18e1_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-backup-rhel8-operator@sha256:3b0397a2f6417d9753158854fbaf9c25d3d76b926bf1edf28c3906b12ae93654_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-backup-rhel8-operator@sha256:b778cc31c51a2b8d5458ddefb5398b3e603da117232845fa56f1ced0801a6491_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • rhacm2/cluster-curator-controller-rhel8@sha256:8e34a5d87d837df2db422e3f9b9c084b1318d1ff3a8ac2c4cd825abf5ef20166_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8
  • +170 more not shown

✅ Remediation

For Red Hat Advanced Cluster Management for Kubernetes, see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/index For details on how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html-single/install/index#installing Workaround: Customers should make an attempt to run current binaries/architectures and not rely on compatibility layers to run older binaries/architectures. In case older binaries/architectures are needed, sandboxing should be used to address such problems and guard the bug. Workaround: Prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `proto-max-bulk-len` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the above configuration parameters. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: Prevent unauthenticated users from connecting to Redis by using network access control tools (e.g., firewalls) or enabling TLS and requiring users to authenticate using client side certificates. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `set-max-intset-entries` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this.

🔗 References (30)