Red Hat Security Advisory

RHSA-2019:3905

OpenShift Container Platform 3.11 atomic-openshift security update

Released 2019-11-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.11 atomic-openshift-3.11.154-1.git.0.7a097ad.el7, atomic-openshift-clients-3.11.154-1.git.0.7a097ad.el7, atomic-openshift-clients-redistributable-3.11.154-1.git.0.7a097ad.el7 +10

Fixes 2 records

TI-2019-08423 CVE-2019-11253 · GHSA-pmqp-h87c-mr78

Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

MEDIUM 54

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.25939 Published 2019-10-17 Partial fix · 1.13.12, 1.14.8 +2 CWE-20

TI-2019-08421 CVE-2019-11251 · GHSA-6qfg-8799-r575

kubectl cp allows symlink directory traversal

LOW 31

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of th…

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.0262 Published 2020-02-03 Partial fix · 1.13.11, 1.14.7 +2 CWE-61