Red Hat Security Advisory

RHSA-2018:3537

OpenShift Container Platform 3.11 security update

Released 2018-11-20 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.11 atomic-openshift-3.11.43-1.git.0.647ac05.el7, atomic-openshift-clients-redistributable-3.11.43-1.git.0.647ac05.el7, atomic-openshift-docker-excluder-3.11.43-1.git.0.647ac05.el7 +11

Fixes 3 records

TI-2018-16130 CVE-2018-1002105 · GHSA-579h-mv94-g4gp

Improper privilege management in Kubernetes

HIGH 84

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection thr…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.86978 Published 2018-12-05 Partial fix · v1.10.11, v1.11.5 +4 CWE-388

TI-2018-08691 CVE-2018-12115 · GHSA-q85m-543x-pwpc

Out-of-bounds write in NodeJS Node.js

MEDIUM 43

In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to wri…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.07779 Published 2018-08-21 Partial fix CWE-787

TI-2018-02800 CVE-2018-3830 · GHSA-p82g-h4qx-f53f

Cross-site scripting in Elastic Kibana

LOW 31

Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of o…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01628 Published 2018-09-19 Fixed CWE-79