RHSA-2023:4972CriticalCVSS 9.8

Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.1.8 security updates and bug fixes

Published
September 5, 2023
Last Modified
August 6, 2026

🔗 CVE IDs covered (3)

CVE-2023-3089 →CVE-2023-37466 →CVE-2023-37903 →

📋 Description

CVE-2023-3089 — openshift: OCP & FIPS mode CVE-2023-37466 — vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code CVE-2023-37903 — vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code

🎯 Affected products153

  • multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:5789accbabd3b8f0913943a88769b3a48ba8046b65fc1cb5b16f4f7432d77d4f_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:5e8cb8f3c04a5ac276ccdabc356436ea0c2c166863241cae27958e732b817d45_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:a8cf9f020c5161e7124d4fea3263c71ed7a7f337dbb8f4706c64b89612a278ca_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:c94af4dd349ca2cb0abd4fb617c8c32f0ebab6fdd772b115dd03495ca2ffa352_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:05254568c9adda82d584e1d394d573251430fa2ac9781ce84d7a9af4c031410b_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:3fa4e15de3c4e768651b09c72ca655c3b8459a77f2cc62dc996c25855eb68af8_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:58cecf77c385e74bc06083543d77deac5ef38d9fd58ae3e5e41cadb1492c48c2_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:ea2ba761ac5b9dba42e0a541592c98043db0fbb72d209bb74916fd94c0fecdfb_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:5603b6e767c8fcd8776d12f85a643f27b1edd3ef913680e90387393ac27bf634_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:59849890e6463397a5377d6609f83ae55e188f231ec314426df329d97ee51de7_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:5c3a88923e85492e0e022911577edd4255106f6411a0cd2c9b545dadd2756b90_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:c99921f3939ef89592af51fca66408c3d68b0a36932c4709baa6e9e0816bfbd5_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:1cc3c2480a4b6bf17e8d041a49d7d6523ae47ae0671621f03fc6baab49f81cfc_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:b59418219b77ab15a7229996ad4ca5eaff86211222c50bc28a7f778fa6221cfb_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:4a4cbc97d2ce7c4f76363856043fbf0f41ff197be3dc8778987c0fc08eb5dc64_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:60218a7b7c13047c8b19ad862e1e8f32140a4b607ef07ecfd5fd8bfd0eb2ad97_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:ca77593eb39d23c6325a520bc0e52e54591256123a73dbf91f139fbc144dac5f_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:945d137a8e00ad9eee996ca2c1724d8eac28ab2ccf0eab15a30329a7ec3051d1_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:9600444f37fd51d3519d4598728d5fa7863c46c557939428f5172e08aadb597d_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:d7bf2785b3317cb57b92a14ef4b54f2e0901ef07455258543b3125a06e5acf07_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:27fb83e2cff127125f11fbe5c4bb63153d063559ca1be0d66b6537187ba88766_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:768672294e183c0f6645a27a74c11df9355f63e600e9f54e240106ba3ad8932a_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:f587a337878fcd58996621900956c51ed3a58b288ef8b0258c1e516f42aa8b27_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:f798eef31b07bcd9b9e1436dc4fa72c4855364120ec40a7fb40a0ad064cf0aa1_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/backplane-rhel8-operator@sha256:1ce23f830184ed69a200379a40be53caabfe6a84609f15ac651143300545bca5_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/backplane-rhel8-operator@sha256:4d8ab8e42becd608d0959d9cc80cd56fabd3ce06aee3777b7324a1db323f2d69_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/backplane-rhel8-operator@sha256:64ab5eceba2e0c40c8f16a1275c779bd86ced758e6a3032d385f0e8758ca42f2_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/backplane-rhel8-operator@sha256:d7b939249ab05759da312e1381ec86e6ae52d304ac3210e07322ffb87c70d5f3_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/cluster-api-provider-agent-rhel8@sha256:076b50522bec8b752587461ab513ed353aeb1756c65958975e47a138c1eddc5a_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • +123 more not shown

✅ Remediation

For information and instructions for these updates, see the following article: https://access.redhat.com/solutions/7022540. For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/multicluster_engine/multicluster_engine_overview#installing-while-connected-online-mce Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (7)