Security update for kubernetes1.23

Announcement ID: SUSE-SU-2023:2292-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2021-25749 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-3162 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • CVE-2022-3162 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • CVE-2022-3294 ( SUSE ): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-3294 ( NVD ): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • Containers Module 15-SP4
  • openSUSE Leap 15.3
  • SUSE Enterprise Storage 7.1
  • SUSE Linux Enterprise High Performance Computing 15 SP3
  • SUSE Linux Enterprise High Performance Computing 15 SP4
  • SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3
  • SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
  • SUSE Linux Enterprise Real Time 15 SP4
  • SUSE Linux Enterprise Server 15 SP3
  • SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
  • SUSE Linux Enterprise Server 15 SP4
  • SUSE Linux Enterprise Server for SAP Applications 15 SP3
  • SUSE Linux Enterprise Server for SAP Applications 15 SP4
  • SUSE Manager Proxy 4.3
  • SUSE Manager Retail Branch Server 4.3
  • SUSE Manager Server 4.3

An update that solves three vulnerabilities can now be installed.

Description:

This update for kubernetes1.23 fixes the following issues:

  • add kubernetes1.18-client-common as conflicts with kubernetes-client-bash-completion

  • Split individual completions into separate packages

Update to version 1.23.17:

  • releng: Update images, dependencies and version to Go 1.19.6
  • Update golang.org/x/net to v0.7.0
  • Pin golang.org/x/net to v0.4.0
  • add scale test for probes
  • use custom dialer for http probes
  • use custom dialer for tcp probes
  • add custom dialer optimized for probes
  • egress_selector: prevent goroutines leak on connect() step.
  • tls.Dial() validates hostname, no need to do that manually
  • Fix issue that Audit Server could not correctly encode DeleteOption
  • Do not include scheduler name in the preemption event message
  • Do not leak cross namespace pod metadata in preemption events
  • pkg/controller/job: re-honor exponential backoff
  • releng: Update images, dependencies and version to Go 1.19.5
  • Bump Konnectivity to v0.0.35
  • Improve vendor verification works for each staging repo
  • Update to go1.19
  • Adjust for os/exec changes in 1.19
  • Update golangci-lint to 1.46.2 and fix errors
  • Match go1.17 defaults for SHA-1 and GC
  • update golangci-lint to 1.45.0
  • kubelet: make the image pull time more accurate in event
  • change k8s.gcr.io/pause to registry.k8s.io/pause
  • use etcd 3.5.6-0 after promotion
  • changelog: CVE-2022-3294 and CVE-2022-3162 were fixed in v1.23.14
  • Add CVE-2021-25749 to CHANGELOG-1.23.md
  • Add CVE-2022-3294 to CHANGELOG-1.23.md
  • kubeadm: use registry.k8s.io instead of k8s.gcr.io
  • etcd: Updated to v3.5.5
  • Bump konnectivity network proxy to v0.0.33. Includes a couple bug fixes for better handling of dial failures. Agent & Server include numerous other fixes.
  • kubeadm: allow RSA and ECDSA format keys in preflight check
  • Fixes kubelet log compression on Windows
  • Reduce default gzip compression level from 4 to 1 in apiserver
  • exec auth: support TLS config caching
  • Marshal MicroTime to json and proto at the same precision
  • Windows: ensure runAsNonRoot does case-insensitive comparison on user name
  • update structured-merge-diff to 4.2.3
  • Add rate limiting when calling STS assume role API
  • Fixing issue in generatePodSandboxWindowsConfig for hostProcess containers by where pod sandbox won't have HostProcess bit set if pod does not have a security context but containers specify HostProcess.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • openSUSE Leap 15.3
    zypper in -t patch SUSE-2023-2292=1
  • Containers Module 15-SP4
    zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2023-2292=1
  • SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-2292=1
  • SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-2292=1
  • SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-2292=1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP3
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-2292=1
  • SUSE Enterprise Storage 7.1
    zypper in -t patch SUSE-Storage-7.1-2023-2292=1

Package List:

  • openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64)
    • kubernetes1.23-kubeadm-1.23.17-150300.7.6.1
    • kubernetes1.23-client-1.23.17-150300.7.6.1
    • kubernetes1.23-kubelet-common-1.23.17-150300.7.6.1
    • kubernetes1.23-apiserver-1.23.17-150300.7.6.1
    • kubernetes1.23-controller-manager-1.23.17-150300.7.6.1
    • kubernetes1.23-scheduler-1.23.17-150300.7.6.1
    • kubernetes1.23-proxy-1.23.17-150300.7.6.1
    • kubernetes1.23-client-common-1.23.17-150300.7.6.1
    • kubernetes1.23-kubelet-1.23.17-150300.7.6.1
  • openSUSE Leap 15.3 (noarch)
    • kubernetes1.23-client-fish-completion-1.23.17-150300.7.6.1
    • kubernetes1.23-client-bash-completion-1.23.17-150300.7.6.1
  • openSUSE Leap 15.3 (ppc64le)
    • kubernetes1.23-apiserver-debuginfo-1.23.17-150300.7.6.1
    • kubernetes1.23-client-debuginfo-1.23.17-150300.7.6.1
    • kubernetes1.23-kubeadm-debuginfo-1.23.17-150300.7.6.1
    • kubernetes1.23-proxy-debuginfo-1.23.17-150300.7.6.1
    • kubernetes1.23-kubelet-debuginfo-1.23.17-150300.7.6.1
    • kubernetes1.23-scheduler-debuginfo-1.23.17-150300.7.6.1
    • kubernetes1.23-controller-manager-debuginfo-1.23.17-150300.7.6.1
  • Containers Module 15-SP4 (aarch64 ppc64le s390x x86_64)
    • kubernetes1.23-client-common-1.23.17-150300.7.6.1
    • kubernetes1.23-client-1.23.17-150300.7.6.1
  • Containers Module 15-SP4 (ppc64le)
    • kubernetes1.23-client-debuginfo-1.23.17-150300.7.6.1
  • SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64)
    • kubernetes1.23-client-common-1.23.17-150300.7.6.1
    • kubernetes1.23-client-1.23.17-150300.7.6.1
  • SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64)
    • kubernetes1.23-client-common-1.23.17-150300.7.6.1
    • kubernetes1.23-client-1.23.17-150300.7.6.1
  • SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64)
    • kubernetes1.23-client-common-1.23.17-150300.7.6.1
    • kubernetes1.23-client-1.23.17-150300.7.6.1
  • SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (ppc64le)
    • kubernetes1.23-client-debuginfo-1.23.17-150300.7.6.1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)
    • kubernetes1.23-client-common-1.23.17-150300.7.6.1
    • kubernetes1.23-client-1.23.17-150300.7.6.1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le)
    • kubernetes1.23-client-debuginfo-1.23.17-150300.7.6.1
  • SUSE Enterprise Storage 7.1 (aarch64 x86_64)
    • kubernetes1.23-client-common-1.23.17-150300.7.6.1
    • kubernetes1.23-client-1.23.17-150300.7.6.1

References: