Bug 2208493

Summary:	clone 4.9: Security CVE fix on rook - CVE-2022-3931, CVE-2023-24999, CVE-2023-0620
Product:	[Red Hat Storage] Red Hat OpenShift Data Foundation	Reporter:	Subham Rai <srai>
Component:	rook	Assignee:	Subham Rai <srai>
Status:	CLOSED CANTFIX	QA Contact:	Neha Berry <nberry>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	4.10	CC:	gmenath, muagarwa, nberry, ocs-bugs, odf-bz-bot, security-response-team, srai
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	2190145	Environment:
Last Closed:	2023-05-23 15:21:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2190145
Bug Blocks:	2208491

Description Subham Rai 2023-05-19 09:18:53 UTC

+++ This bug was initially created as a clone of Bug #2190145 +++

Description of problem (please be detailed as possible and provide log
snippests):
We are facing security vulnerability with the packages using on ocs-operator (https://github.com/red-hat-storage/ocs-operator) which is Rook and Vault.

CVE-2022-3931
CVE-2023-24999
CVE-2023-0620

The following CVEs are reeported againt packages rook and Vault. Rook has to be atleast updated to version v1.11.3 or above to fix the issues as Vault CVE is present in rook version lower than v1.11.3.

I can see the similar error on ODF version 4.12, 4.11, 4.10 and 4.9. So the fixes has to be provided for all these version.

Also the odf-operator (https://github.com/red-hat-storage/odf-operator) which is having ocs-operator as dependent repo has to be updated once fixes are rolled out


Version of all relevant components (if applicable):
4.12, 4.11, 4.10 and 4.9


Does this issue impact your ability to continue to work with the product
(please explain in detail what is the user impact)?
Yes, we are getting CVE error in our repos


Is there any workaround available to the best of your knowledge?
update the vulnerable package to the compactable version


Rate from 1 - 5 the complexity of the scenario you performed that caused this
bug (1 - very simple, 5 - very complex)?
1

Can this issue reproducible?
yes

Can this issue reproduce from the UI?


If this is a regression, please provide more details to justify this:


Steps to Reproduce:
1.
2.
3.


Actual results:
Packages with CVEs found

Expected results:
All packages will not have any CVEs


Additional info:

--- Additional comment from RHEL Program Management on 2023-04-27 09:44:14 UTC ---

This bug having no release flag set previously, is now set with release flag 'odf‑4.13.0' to '?', and so is being proposed to be fixed at the ODF 4.13.0 release. Note that the 3 Acks (pm_ack, devel_ack, qa_ack), if any previously set while release flag was missing, have now been reset since the Acks are to be set against a release flag.

--- Additional comment from Gayathri Menath on 2023-04-27 10:08:20 UTC ---

@gayathri.m

--- Additional comment from Mudit Agarwal on 2023-05-10 03:21:12 UTC ---

Subham, which version of vault are we using in 4.13 to 4.9 in rook?
Please list here.

--- Additional comment from Gayathri Menath on 2023-05-11 07:55:59 UTC ---

https://bugzilla.redhat.com/show_bug.cgi?id=2203081 -  I have raised one more issue, could you please take care while fixing this issue as well.

--- Additional comment from Subham Rai on 2023-05-11 09:37:27 UTC ---

(In reply to Mudit Agarwal from comment #3)
> Subham, which version of vault are we using in 4.13 to 4.9 in rook?
> Please list here.

4.13: github.com/hashicorp/vault v1.13.1

4.12: github.com/hashicorp/vault v1.11.2

4.11:  github.com/hashicorp/vault v1.10.0

4.10: 	github.com/hashicorp/vault v1.8.2

4.19: github.com/hashicorp/vault v1.8.2

Done.

Do you also need the vault API and other vault pkg versions?

--- Additional comment from Mudit Agarwal on 2023-05-15 17:41:00 UTC ---

Thanks Subham, so this needs to be fixed from 4.12 till 4.9
I am not sure whether it is possible to upgrade this package in the z-stream or not due to other dependencies.

Subham, do you want to check this from rook's perspective?

--- Additional comment from Subham Rai on 2023-05-16 14:54:10 UTC ---

I'll check from rook side, I'm keeping needinfo on me so that I have this on track.

--- Additional comment from Gayathri Menath on 2023-05-19 06:01:13 UTC ---

Can I get some update on this? Could you please share the ETA?

--- Additional comment from Subham Rai on 2023-05-19 06:21:25 UTC ---

by early next week.