RHEL has shipped on 22 August 2023 "subscription-manager" security update RHSA with fix for "Important" CVE = RHSA-2023:4708 - Security Advisory == https://access.redhat.com/errata/RHSA-2023:4708 = RHSA-2023:4707 - Security Advisory == https://access.redhat.com/errata/RHSA-2023:4707 = RHSA-2023:4706 - Security Advisory == https://access.redhat.com/errata/RHSA-2023:4706 = RHSA-2023:4705 - Security Advisory == https://access.redhat.com/errata/RHSA-2023:4705 = CVE-2023-3899 == https://access.redhat.com/security/cve/CVE-2023-3899 = RPM Errata == https://errata.devel.redhat.com/advisory/118548 == https://errata.devel.redhat.com/advisory/118559 == https://errata.devel.redhat.com/advisory/118630 == https://errata.devel.redhat.com/advisory/118649 = Impacts multiple container images at ODF == Rook Ceph Operator (odf4/rook-ceph-rhel9-operator) == ODF MultiCluster Console (odf4/odf-multicluster-console-rhel9) == OpenShift Data Foundation Console (odf4/odf-console-rhel9) == Ceph Container Storage Interface (odf4/cephcsi-rhel9) == Multi-Cloud Object Gateway Core (odf4/mcg-core-rhel9) == ODF MultiCluster Console (odf4/odf-multicluster-console-rhel8) == OpenShift Data Foundation LVM Must Gather (odf4/odf-lvm-must-gather-rhel8) == OpenShift Data Foundation Must Gather (odf4/ocs-must-gather-rhel8) == OpenShift Data Foundation Console (odf4/odf-console-rhel8) == Multi-Cloud Object Gateway Core (odf4/mcg-core-rhel8) == Rook Ceph Operator (odf4/rook-ceph-rhel8-operator) == Ceph Container Storage Interface (odf4/cephcsi-rhel8) = Packages Impacted == python3-cloud-what == python3-subscription-manager-rhsm == subscription-manager == subscription-manager-rhsm-certificates == dnf-plugin-subscription-manager == python3-syspurpose Being "Important" CVE, the number of days to ship the Container images with fixes is 30 days after fixes have been shipped at RHEL. So the mandatory due date to ship the ODF 4.11 Container images with updated packages is 21 September 2023, to prevent CHI scores (Health Score) from dropping to grade C.
Verified with ODF 4.11.11 As per: https://access.redhat.com/errata/RHSA-2023:4705 https://access.redhat.com/errata/RHSA-2023:4706 The mentioned versions are: subscription-manager-1.28.29.1-2.el8_6.src.rpm and subscription-manager-1.28.36-3.el8_8.src.rpm From last execution of 4.11 collected logs: https://url.corp.redhat.com/d591fe5 All the containers except sidecar containers are having above mentioned versions ./core-rpm.log:subscription-manager-1.28.36-3.el8_8 ./db-rpm.log:subscription-manager-1.28.36-3.el8_8 ./odf-console-rpm.log:subscription-manager-1.28.36-3.el8_8 Hence closing the bug
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Red Hat OpenShift Data Foundation 4.11.11 bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:5393