Bug 2237864

Summary:	Include at ODF 4.11 container images the RHEL CVE fix on "subscription-manager"
Product:	[Red Hat Storage] Red Hat OpenShift Data Foundation	Reporter:	Rejy M Cyriac <rcyriac>
Component:	distribution	Assignee:	Mudit Agarwal <muagarwa>
Status:	CLOSED ERRATA	QA Contact:	Joy John Pinto <jopinto>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	4.11	CC:	kramdoss, odf-bz-bot
Target Milestone:	---
Target Release:	ODF 4.11.11
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-09-28 07:39:49 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Rejy M Cyriac 2023-09-07 11:24:53 UTC

RHEL has shipped on 22 August 2023 "subscription-manager" security update RHSA with fix for "Important" CVE


= RHSA-2023:4708 - Security Advisory
  == https://access.redhat.com/errata/RHSA-2023:4708
= RHSA-2023:4707 - Security Advisory
  == https://access.redhat.com/errata/RHSA-2023:4707

= RHSA-2023:4706 - Security Advisory
  == https://access.redhat.com/errata/RHSA-2023:4706
= RHSA-2023:4705 - Security Advisory
  == https://access.redhat.com/errata/RHSA-2023:4705


= CVE-2023-3899
  == https://access.redhat.com/security/cve/CVE-2023-3899


= RPM Errata
  == https://errata.devel.redhat.com/advisory/118548
  == https://errata.devel.redhat.com/advisory/118559
  == https://errata.devel.redhat.com/advisory/118630
  == https://errata.devel.redhat.com/advisory/118649


= Impacts multiple container images at ODF
  == Rook Ceph Operator (odf4/rook-ceph-rhel9-operator)
  == ODF MultiCluster Console  (odf4/odf-multicluster-console-rhel9)
  == OpenShift Data Foundation Console (odf4/odf-console-rhel9)
  == Ceph Container Storage Interface (odf4/cephcsi-rhel9)
  == Multi-Cloud Object Gateway Core (odf4/mcg-core-rhel9)
  == ODF MultiCluster Console (odf4/odf-multicluster-console-rhel8)
  == OpenShift Data Foundation LVM Must Gather (odf4/odf-lvm-must-gather-rhel8)
  == OpenShift Data Foundation Must Gather (odf4/ocs-must-gather-rhel8)
  == OpenShift Data Foundation Console (odf4/odf-console-rhel8)
  == Multi-Cloud Object Gateway Core (odf4/mcg-core-rhel8)
  == Rook Ceph Operator (odf4/rook-ceph-rhel8-operator)
  == Ceph Container Storage Interface (odf4/cephcsi-rhel8)


= Packages Impacted
  == python3-cloud-what
  == python3-subscription-manager-rhsm
  == subscription-manager
  == subscription-manager-rhsm-certificates
  == dnf-plugin-subscription-manager
  == python3-syspurpose


Being "Important" CVE, the number of days to ship the Container images with fixes is 30 days after fixes have been shipped at RHEL. So the mandatory due date to ship the ODF 4.11 Container images with updated packages is 21 September 2023, to prevent CHI scores (Health Score) from dropping to grade C.

Comment 7 Joy John Pinto 2023-09-26 10:38:08 UTC

Verified with ODF 4.11.11

As per:
https://access.redhat.com/errata/RHSA-2023:4705
https://access.redhat.com/errata/RHSA-2023:4706

The mentioned versions are:
subscription-manager-1.28.29.1-2.el8_6.src.rpm and subscription-manager-1.28.36-3.el8_8.src.rpm

From last execution of 4.11 collected logs:
https://url.corp.redhat.com/d591fe5

All the containers except sidecar containers are having above mentioned versions
./core-rpm.log:subscription-manager-1.28.36-3.el8_8
./db-rpm.log:subscription-manager-1.28.36-3.el8_8
./odf-console-rpm.log:subscription-manager-1.28.36-3.el8_8

Hence closing the bug

Comment 11 errata-xmlrpc 2023-09-28 07:39:49 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenShift Data Foundation 4.11.11 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:5393