Bug 1974765

Summary:	Include at OCS 4.6 container images the CVE fix on "glib2" from RHEL8
Product:	[Red Hat Storage] Red Hat OpenShift Container Storage	Reporter:	Rejy M Cyriac <rcyriac>
Component:	distribution	Assignee:	Mudit Agarwal <muagarwa>
Status:	CLOSED ERRATA	QA Contact:	Raz Tamir <ratamir>
Severity:	high	Docs Contact:
Priority:	high
Version:	4.6	CC:	aeyal, asriram, bniver, madam, muagarwa, nberry, ocs-bugs, sostapov, ykaul
Target Milestone:	---	Keywords:	ZStream
Target Release:	OCS 4.6.6
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	4.6.6-426.ci	Doc Type:	Bug Fix
Doc Text:	Updated OpenShift Container 4.6 images include important CVE fixes on "glib2" that were shipped with Red Hat Enterprise Linux 8. = CVE-2021-27219 == https://access.redhat.com/security/cve/CVE-2021-27219	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-07-07 18:53:00 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Rejy M Cyriac 2021-06-22 13:48:18 UTC

RHEL 8 has shipped "glib2" update with fixes for "Important" CVE


= RHSA-2021:2170 - Security Advisory
  == https://access.redhat.com/errata/RHSA-2021:2170


= CVE-2021-27219
  == https://access.redhat.com/security/cve/CVE-2021-27219


= Updated "glib2" build
  == glib2-2.56.4-10.el8_4


= RHEL8 Errata
  == https://errata.devel.redhat.com/advisory/76577


= Impacted OCS 4.x Container images
  == ocs-must-gather-container
  == ocs-operator-container
  == noobaa-core-container
  == noobaa-operator-container
  == cephcsi-container
  == rook-ceph-operator-container


The fix to 'Important' CVE on "glib2" is to be included at the impacted OCS container images, through inclusion of the relevant "glib2" update at the updated relevant OCS container images.

Comment 1 Mudit Agarwal 2021-06-22 13:53:20 UTC

*** Bug 1974760 has been marked as a duplicate of this bug. ***

Comment 12 errata-xmlrpc 2021-07-07 18:53:00 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenShift Container Storage 4.6.6 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:2669