Red Hat Security Advisory

RHSA-2018:2013

OpenShift Container Platform 3.9 security, bug fix, and enhancement update

Released 2018-06-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.9 atomic-openshift-3.9.31-1.git.0.ef9737b.el7, atomic-openshift-clients-3.9.31-1.git.0.ef9737b.el7, atomic-openshift-clients-redistributable-3.9.31-1.git.0.ef9737b.el7 +23

Fixes 3 records

TI-2018-01004 CVE-2018-1085 · GHSA-42gw-292w-c96g

Improper authentication in [UNKNOWN] openshift-ansible

MEDIUM 46

openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0228 Published 2018-06-15 Fixed CWE-592

TI-2018-07659 CVE-2018-10843 · GHSA-h5q5-9vcx-54g7

Improper input validation in [UNKNOWN] source-to-image

MEDIUM 41

source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalation which allows the assemble script to run as the root user…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01388 Published 2018-07-02 Fixed CWE-20

TI-2018-00990 CVE-2018-1070 · GHSA-mfw5-7x4h-m4v5

Improper input validation in [UNKNOWN] routing

LOW 34

routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which can cause an entire shard to be brought down.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00859 Published 2018-06-12 Fixed CWE-20