Skip to content
OpenAdvisories
High ELSA-2023-12772 4 CVEs

Important: olcne security update (Oracle Linux 8)

Published Sep 11, 2023 · Updated Sep 11, 2023

Ecosystem: Oracle Linux

Summary

istio
[1.17.5-1]
- Addresses CVE CVE-2023-35941, CVE-2023-35942, CVE-2023-35943, CVE-2023-35944.

kubevirt
[0.58.0-3]
- Ensure that selinux build tags are set for all Go builds

olcne
[1.7.2-3]
- Mofify kubevirt image tag to use virt-operator tag instead of kubevirt-version

[1.7.2-2]
- Update kubevirt image versions fixing selinux=enforce not being supported

[1.7.2-1]
- Add Istio-1.17.5 and Istio-1.16.7 to address CVE's
- CVE-2023-35941
- CVE-2023-35942
- CVE-2023-35943
- CVE-2023-35944

[1.7.0-10]
- Remove worker-nodes enforcement from olcnectl provision

[1.7.0-9]
- Add resolutions for jenkins build failures

Fixed packages 19

ReleasePackageFixed in
Oracle Linux · 8 istio 0:1.17.5-1.el8
Oracle Linux · 8 istio-istioctl 0:1.17.5-1.el8
Oracle Linux · 8 olcne-agent 0:1.7.2-3.el8
Oracle Linux · 8 olcne-api-server 0:1.7.2-3.el8
Oracle Linux · 8 olcne-calico-chart 0:1.7.2-3.el8
Oracle Linux · 8 olcne-gluster-chart 0:1.7.2-3.el8
Oracle Linux · 8 olcne-grafana-chart 0:1.7.2-3.el8
Oracle Linux · 8 olcne-istio-chart 0:1.7.2-3.el8
Oracle Linux · 8 olcne-kubevirt-chart 0:1.7.2-3.el8
Oracle Linux · 8 olcne-metallb-chart 0:1.7.2-3.el8
Oracle Linux · 8 olcne-multus-chart 0:1.7.2-3.el8
Oracle Linux · 8 olcne-nginx 0:1.7.2-3.el8
Oracle Linux · 8 olcne-oci-ccm-chart 0:1.7.2-3.el8
Oracle Linux · 8 olcne-olm-chart 0:1.7.2-3.el8
Oracle Linux · 8 olcne-prometheus-chart 0:1.7.2-3.el8
Oracle Linux · 8 olcne-rook-chart 0:1.7.2-3.el8
Oracle Linux · 8 olcne-utils 0:1.7.2-3.el8
Oracle Linux · 8 olcnectl 0:1.7.2-3.el8
Oracle Linux · 8 virtctl 0:0.58.0-3.el8

Vulnerabilities 4

  • High 8.6
    CVE-2023-35941

    Envoy vulnerable to OAuth2 credentials exploit with permanent validity

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This…

    envoyproxy envoy
  • High 8.2
    CVE-2023-35944

    Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes

    Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can…

    envoyproxy envoy
  • Medium 6.5
    CVE-2023-35942

    Envoy's gRPC access log crash caused by the listener draining

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is dr…

    envoyproxy envoy
  • Medium 6.3
    CVE-2023-35943

    Envoy vulnerable to CORS filter segfault when origin header is removed

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the `origin` header is removed and deleted between `decod…

    envoyproxy envoy