Summary
olcne
[1.3.2-2]
- Turn off default PodDisruptionBudget in istio template to unblock kubernetes module upgrade
- Update Kubernetes version to 1.20.11 to address CVE-2021-25741
- Update Istio to 1.9.8, 1.10.4 to address CVE-2021-32777, CVE-2021-32778, CVE-2021-32779, CVE-2021-32780 & CVE-2021-32781
- Update proxyv2 image to select iptables legacy or latest based on host operating system
- Fix major.minor k8s version
istio
[1.9.8-3]
- Updated iptables-switch for OL8 and OL7 logic
[1.9.8-2]
- Bump release, addresses the following envoy CVEs,
CVE-2021-32777, CVE-2021-32778, CVE-2021-32779, CVE-2021-32780 & CVE-2021-32781
[1.9.8-1]
- Added Oracle specific files for 1.9.8-1
istio
[1.10.4-3]
- Updated iptables-switch for OL8 and OL7 logic
[1.10.4-2]
- Bump release, addresses the following envoy CVEs,
CVE-2021-32777, CVE-2021-32778, CVE-2021-32779, CVE-2021-32780 & CVE-2021-32781
[1.10.4-1]
- Added Oracle specific files for 1.10.4-1
kubernetes
[1.20.11-4]
- Fix major.minor version
[1.20.11-3]
- Updated iptables-switch for OL8 and OL7 logic
[1.20.11-2]
- Bump release for CVE fix, addresses CVE-2021-25741
[1.20.11-1]
- Added Oracle specific build files for Kubernetes
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | istio | 0:1.10.4-3.el7 |
| Oracle Linux · 7 | istio-istioctl | 0:1.10.4-3.el7 |
| Oracle Linux · 7 | kubeadm | 0:1.20.11-4.el7 |
| Oracle Linux · 7 | kubectl | 0:1.20.11-4.el7 |
| Oracle Linux · 7 | kubelet | 0:1.20.11-4.el7 |
| Oracle Linux · 7 | olcne-agent | 0:1.3.2-2.el7 |
| Oracle Linux · 7 | olcne-api-server | 0:1.3.2-2.el7 |
| Oracle Linux · 7 | olcne-grafana-chart | 0:1.3.2-2.el7 |
| Oracle Linux · 7 | olcne-istio-chart | 0:1.3.2-2.el7 |
| Oracle Linux · 7 | olcne-nginx | 0:1.3.2-2.el7 |
| Oracle Linux · 7 | olcne-olm-chart | 0:1.3.2-2.el7 |
| Oracle Linux · 7 | olcne-prometheus-chart | 0:1.3.2-2.el7 |
| Oracle Linux · 7 | olcne-utils | 0:1.3.2-2.el7 |
| Oracle Linux · 7 | olcnectl | 0:1.3.2-2.el7 |
Vulnerabilities 6
-
High 8.8CVE-2021-25741 Public exploit
Symlink Exchange Can Allow Host Filesystem Access
A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.
-
High 8.6
Incorrect concatenation of multiple value request headers in ext-authz extension
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value header…
-
High 8.6
Incorrectly handling of URI '#fragment' element as part of the path element
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for …
-
High 8.6
Incorrect handling of H/2 GOAWAY followed by SETTINGS frames
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The c…
-
High 8.6
Continued processing of requests after locally generated response
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when loca…
-
Medium 5.8
Excessive CPU utilization when closing HTTP/2 streams
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of…