Bug 1992955 (CVE-2021-3703) - CVE-2021-3703 serverless: incomplete fix for CVE-2021-27918 / CVE-2021-31525 / CVE-2021-33196
Summary: CVE-2021-3703 serverless: incomplete fix for CVE-2021-27918 / CVE-2021-31525 ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-3703
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: CVE-2021-3724 CVE-2021-23161 CVE-2021-23156 (view as bug list)
Depends On:
Blocks: 1992954 1995392
TreeView+ depends on / blocked
 
Reported: 2021-08-12 06:24 UTC by Paramvir jindal
Modified: 2021-09-29 19:19 UTC (History)
9 users (show)

Fixed In Version: Serverless 1.17.0
Clone Of:
Environment:
Last Closed: 2021-09-16 18:21:10 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3555 0 None None None 2021-09-16 15:22:12 UTC
Red Hat Product Errata RHSA-2021:3556 0 None None None 2021-09-16 18:40:03 UTC

Description Paramvir jindal 2021-08-12 06:24:57 UTC 
It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless 1.16.0 and Serverless client kn 1.16.0. These will be fixed with next release.
Comment 4 Chess Hazlett 2021-08-19 18:25:31 UTC 
*** Bug 1995394 has been marked as a duplicate of this bug. ***
Comment 5 Chess Hazlett 2021-08-19 18:25:50 UTC 
*** Bug 1995395 has been marked as a duplicate of this bug. ***
Comment 6 Chess Hazlett 2021-08-19 18:26:11 UTC 
*** Bug 1995396 has been marked as a duplicate of this bug. ***
Comment 7 Paramvir jindal 2021-08-23 04:46:10 UTC 
Since only the Knative CLI build used an older version of Go that did not have the CVE fix, marking knative-serving and knative-eventing as not affected.
Comment 10 errata-xmlrpc 2021-09-16 15:22:10 UTC 
This issue has been addressed in the following products:

  Openshift Serverless 1 on RHEL 8

Via RHSA-2021:3555 https://access.redhat.com/errata/RHSA-2021:3555
Comment 11 Product Security DevOps Team 2021-09-16 18:21:10 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3703
Comment 12 errata-xmlrpc 2021-09-16 18:40:02 UTC 
This issue has been addressed in the following products:

  Openshift Serveless 1.17

Via RHSA-2021:3556 https://access.redhat.com/errata/RHSA-2021:3556
Note You need to log in before you can comment on or make changes to this bug.