Red Hat Security Advisory

RHSA-2018:0475

Red Hat OpenShift Container Platform security update

Released 2018-03-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.3 atomic-openshift-3.3.1.46.11-1.git.4.e236015.el7, atomic-openshift-clients-3.3.1.46.11-1.git.4.e236015.el7, atomic-openshift-clients-redistributable-3.3.1.46.11-1.git.4.e236015.el7 +9
Red Hat OpenShift Container Platform 3.4 atomic-openshift-3.4.1.44.38-1.git.4.bb8df08.el7, atomic-openshift-clients-3.4.1.44.38-1.git.4.bb8df08.el7, atomic-openshift-clients-redistributable-3.4.1.44.38-1.git.4.bb8df08.el7 +9
Red Hat OpenShift Container Platform 3.5 atomic-openshift-3.5.5.31.48-1.git.4.ff6153e.el7, atomic-openshift-clients-3.5.5.31.48-1.git.4.ff6153e.el7, atomic-openshift-clients-redistributable-3.5.5.31.48-1.git.4.ff6153e.el7 +9
Red Hat OpenShift Container Platform 3.6 atomic-openshift-3.6.173.0.96-1.git.4.e6301f8.el7, atomic-openshift-clients-3.6.173.0.96-1.git.4.e6301f8.el7, atomic-openshift-clients-redistributable-3.6.173.0.96-1.git.4.e6301f8.el7 +12
Red Hat OpenShift Container Platform 3.7 atomic-openshift-3.7.23-1.git.5.83efd71.el7, atomic-openshift-clients-3.7.23-1.git.5.83efd71.el7, atomic-openshift-clients-redistributable-3.7.23-1.git.5.83efd71.el7 +13

Fixes 2 records

TI-2017-14755 CVE-2017-1002101 · GHSA-rqgw-vh6p-qf7j

Link following in Kubernetes

MEDIUM 56

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can…

CVSS 3.0CRITICAL 9.6 Network Low privileges No interaction EPSS 0.13267 Published 2018-03-13 Partial fix · v1.7.14, v1.8.9 +1 CWE-59

TI-2017-14756 CVE-2017-1002102 · GHSA-mm7g-f2gg-cw8g

Improper access control in Kubernetes

LOW 33

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories fr…

CVSS 3.0HIGH 7.1 Network Low privileges No interaction EPSS 0.01101 Published 2018-03-13 Partial fix · v1.7.14, v1.8.9 +4 CWE-284