Red Hat Security Advisory

RHSA-2018:2908

OpenShift Container Platform 3.9 security update

Released 2018-11-20 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.9 atomic-openshift-3.9.51-1.git.0.dc3a40b.el7, atomic-openshift-clients-3.9.51-1.git.0.dc3a40b.el7, atomic-openshift-clients-redistributable-3.9.51-1.git.0.dc3a40b.el7 +11

Fixes 2 records

TI-2018-16130 CVE-2018-1002105 · GHSA-579h-mv94-g4gp

Improper privilege management in Kubernetes

HIGH 84

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection thr…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.86978 Published 2018-12-05 Partial fix · v1.10.11, v1.11.5 +4 CWE-388

TI-2018-10497 CVE-2018-14632 · GHSA-gxhv-3hwf-wjp9

Out-of-bounds write in Red Hat atomic-openshift

LOW 38

An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before 3.7.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.02229 Published 2018-09-06 Partial fix · 0.5.2, 3.0.1-0.20180525145409-4c9aadca8f89 CWE-787