SUSE-SU-2023:2292-1: moderate: Security update for kubernetes1.23

Thu May 25 08:30:08 UTC 2023

# Security update for kubernetes1.23

Announcement ID: SUSE-SU-2023:2292-1  
Rating: moderate  
References:

Cross-References:

  * CVE-2021-25749
  * CVE-2022-3162
  * CVE-2022-3294

CVSS scores:

  * CVE-2021-25749 ( NVD ):  7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2022-3162 ( SUSE ):  6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  * CVE-2022-3162 ( NVD ):  6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  * CVE-2022-3294 ( SUSE ):  6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
  * CVE-2022-3294 ( NVD ):  6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Products:

  * Containers Module 15-SP4
  * SUSE Enterprise Storage 7.1
  * SUSE Linux Enterprise High Performance Computing 15 SP3
  * SUSE Linux Enterprise High Performance Computing 15 SP4
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
  * SUSE Linux Enterprise Real Time 15 SP4
  * SUSE Linux Enterprise Server 15 SP3
  * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
  * SUSE Linux Enterprise Server 15 SP4
  * SUSE Linux Enterprise Server for SAP Applications 15 SP3
  * SUSE Linux Enterprise Server for SAP Applications 15 SP4
  * SUSE Manager Proxy 4.3
  * SUSE Manager Retail Branch Server 4.3
  * SUSE Manager Server 4.3

An update that solves three vulnerabilities can now be installed.

## Description:

This update for kubernetes1.23 fixes the following issues:

  * add kubernetes1.18-client-common as conflicts with kubernetes-client-bash-
    completion

  * Split individual completions into separate packages

Update to version 1.23.17:

  * releng: Update images, dependencies and version to Go 1.19.6
  * Update golang.org/x/net to v0.7.0
  * Pin golang.org/x/net to v0.4.0
  * add scale test for probes
  * use custom dialer for http probes
  * use custom dialer for tcp probes
  * add custom dialer optimized for probes
  * egress_selector: prevent goroutines leak on connect() step.
  * tls.Dial() validates hostname, no need to do that manually
  * Fix issue that Audit Server could not correctly encode DeleteOption
  * Do not include scheduler name in the preemption event message
  * Do not leak cross namespace pod metadata in preemption events
  * pkg/controller/job: re-honor exponential backoff
  * releng: Update images, dependencies and version to Go 1.19.5
  * Bump Konnectivity to v0.0.35
  * Improve vendor verification works for each staging repo
  * Update to go1.19
  * Adjust for os/exec changes in 1.19
  * Update golangci-lint to 1.46.2 and fix errors
  * Match go1.17 defaults for SHA-1 and GC
  * update golangci-lint to 1.45.0
  * kubelet: make the image pull time more accurate in event
  * change k8s.gcr.io/pause to registry.k8s.io/pause
  * use etcd 3.5.6-0 after promotion
  * changelog: CVE-2022-3294 and CVE-2022-3162 were fixed in v1.23.14
  * Add CVE-2021-25749 to CHANGELOG-1.23.md
  * Add CVE-2022-3294 to CHANGELOG-1.23.md
  * kubeadm: use registry.k8s.io instead of k8s.gcr.io
  * etcd: Updated to v3.5.5
  * Bump konnectivity network proxy to v0.0.33. Includes a couple bug fixes for
    better handling of dial failures. Agent & Server include numerous other
    fixes.
  * kubeadm: allow RSA and ECDSA format keys in preflight check
  * Fixes kubelet log compression on Windows
  * Reduce default gzip compression level from 4 to 1 in apiserver
  * exec auth: support TLS config caching
  * Marshal MicroTime to json and proto at the same precision
  * Windows: ensure runAsNonRoot does case-insensitive comparison on user name
  * update structured-merge-diff to 4.2.3
  * Add rate limiting when calling STS assume role API
  * Fixing issue in generatePodSandboxWindowsConfig for hostProcess containers
    by where pod sandbox won't have HostProcess bit set if pod does not have a
    security context but containers specify HostProcess.

## Patch Instructions:

To install this SUSE Moderate update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * Containers Module 15-SP4  
    zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2023-2292=1

  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-2292=1

  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-2292=1

  * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-2292=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP3  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-2292=1

  * SUSE Enterprise Storage 7.1  
    zypper in -t patch SUSE-Storage-7.1-2023-2292=1

## Package List:

  * Containers Module 15-SP4 (aarch64 ppc64le s390x x86_64)
    * kubernetes1.23-client-1.23.17-150300.7.6.1
    * kubernetes1.23-client-common-1.23.17-150300.7.6.1
  * Containers Module 15-SP4 (ppc64le)
    * kubernetes1.23-client-debuginfo-1.23.17-150300.7.6.1
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64
    x86_64)
    * kubernetes1.23-client-1.23.17-150300.7.6.1
    * kubernetes1.23-client-common-1.23.17-150300.7.6.1
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64
    x86_64)
    * kubernetes1.23-client-1.23.17-150300.7.6.1
    * kubernetes1.23-client-common-1.23.17-150300.7.6.1
  * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x
    x86_64)
    * kubernetes1.23-client-1.23.17-150300.7.6.1
    * kubernetes1.23-client-common-1.23.17-150300.7.6.1
  * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (ppc64le)
    * kubernetes1.23-client-debuginfo-1.23.17-150300.7.6.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)
    * kubernetes1.23-client-1.23.17-150300.7.6.1
    * kubernetes1.23-client-common-1.23.17-150300.7.6.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le)
    * kubernetes1.23-client-debuginfo-1.23.17-150300.7.6.1
  * SUSE Enterprise Storage 7.1 (aarch64 x86_64)
    * kubernetes1.23-client-1.23.17-150300.7.6.1
    * kubernetes1.23-client-common-1.23.17-150300.7.6.1

## References:

  * https://www.suse.com/security/cve/CVE-2021-25749.html
  * https://www.suse.com/security/cve/CVE-2022-3162.html
  * https://www.suse.com/security/cve/CVE-2022-3294.html

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20230525/c4d045c2/attachment.htm>