RHEL has shipped on 22 August 2023 "subscription-manager" security update RHSA with fix for "Important" CVE = RHSA-2023:4708 - Security Advisory == https://access.redhat.com/errata/RHSA-2023:4708 = RHSA-2023:4707 - Security Advisory == https://access.redhat.com/errata/RHSA-2023:4707 = RHSA-2023:4706 - Security Advisory == https://access.redhat.com/errata/RHSA-2023:4706 = RHSA-2023:4705 - Security Advisory == https://access.redhat.com/errata/RHSA-2023:4705 = CVE-2023-3899 == https://access.redhat.com/security/cve/CVE-2023-3899 = RPM Errata == https://errata.devel.redhat.com/advisory/118548 == https://errata.devel.redhat.com/advisory/118559 == https://errata.devel.redhat.com/advisory/118630 == https://errata.devel.redhat.com/advisory/118649 = Impacts multiple container images at ODF == Rook Ceph Operator (odf4/rook-ceph-rhel9-operator) == ODF MultiCluster Console (odf4/odf-multicluster-console-rhel9) == OpenShift Data Foundation Console (odf4/odf-console-rhel9) == Ceph Container Storage Interface (odf4/cephcsi-rhel9) == Multi-Cloud Object Gateway Core (odf4/mcg-core-rhel9) == ODF MultiCluster Console (odf4/odf-multicluster-console-rhel8) == OpenShift Data Foundation LVM Must Gather (odf4/odf-lvm-must-gather-rhel8) == OpenShift Data Foundation Must Gather (odf4/ocs-must-gather-rhel8) == OpenShift Data Foundation Console (odf4/odf-console-rhel8) == Multi-Cloud Object Gateway Core (odf4/mcg-core-rhel8) == Rook Ceph Operator (odf4/rook-ceph-rhel8-operator) == Ceph Container Storage Interface (odf4/cephcsi-rhel8) = Packages Impacted == python3-cloud-what == python3-subscription-manager-rhsm == subscription-manager == subscription-manager-rhsm-certificates == dnf-plugin-subscription-manager == python3-syspurpose Being "Important" CVE, the number of days to ship the Container images with fixes is 30 days after fixes have been shipped at RHEL. So the mandatory due date to ship the ODF 4.13 Container images with updated packages is 21 September 2023, to prevent CHI scores (Health Score) from dropping to grade C.
Containers have greater version of subscription-manager (1.29.26.2-2) than required. Also, no regression issues are seen. % oc rsh -n openshift-storage odf-console-77b8554546-kxnqk sh-5.1$ sh-5.1$ sh-5.1$ rpm -qa | grep 'subsc' subscription-manager-rhsm-certificates-20220623-1.el9.noarch python3-subscription-manager-rhsm-1.29.33.1-2.el9_2.x86_64 libdnf-plugin-subscription-manager-1.29.33.1-2.el9_2.x86_64 subscription-manager-1.29.33.1-2.el9_2.x86_64 % oc rsh -n openshift-storage noobaa-core-0 sh-5.1$ rpm -qa | grep 'subsc' subscription-manager-rhsm-certificates-20220623-1.el9.noarch python3-subscription-manager-rhsm-1.29.33.1-2.el9_2.x86_64 libdnf-plugin-subscription-manager-1.29.33.1-2.el9_2.x86_64 subscription-manager-1.29.33.1-2.el9_2.x86_64 ~ % oc rsh -n openshift-storage csi-cephfsplugin-4h645 sh-4.4# rpm -qa | grep 'subscription' subscription-manager-rhsm-certificates-1.28.29.1-1.el8_6.x86_64 dnf-plugin-subscription-manager-1.28.29.1-1.el8_6.x86_64 python3-subscription-manager-rhsm-1.28.29.1-1.el8_6.x86_64 subscription-manager-1.28.29.1-1.el8_6.x86_64 Moving the bug to verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: Red Hat OpenShift Data Foundation 4.13.3 security and bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2023:5376