Red Hat Security Advisory

RHSA-2020:2362

Red Hat OpenShift Service Mesh security update

Released 2020-06-02 · Red Hat rating Moderate · View on Red Hat →

Fixed in

OpenShift Service Mesh 1.0 servicemesh-grafana-6.2.2-36.el8, servicemesh-grafana-prometheus-6.2.2-36.el8
Red Hat OpenShift Service Mesh 1.0 jaeger-v1.13.1.redhat7-1.el7, kiali-v1.0.11.redhat1-1.el7

Fixes 4 records

TI-2020-08896 CVE-2020-11022 · GHSA-gxr4-xjj5-5px2

jQuery has a potential XSS vulnerability

HIGH 75

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.99215 Published 2020-04-29 Partial fix · 3.5.0, 4.4.0 +2 CWE-79

TI-2019-08009 CVE-2019-10744 · GHSA-jf85-cpcp-j695

Prototype pollution in Snyk lodash

MEDIUM 47

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05006 Published 2019-07-25 Partial fix · 4.17.12, 4.17.14 +2 CWE-1321

TI-2020-06120 CVE-2020-7598 · GHSA-vh95-rmgr-6w4m

Prototype pollution in minimist

LOW 35

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.01931 Published 2020-03-11 Partial fix · 0.2.1, 1.2.3 CWE-1321

TI-2020-09961 CVE-2020-12459 · GHSA-m25m-5778-fm22

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files…

LOW 25

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0032 Published 2020-04-29 Partial fix · 7.2.1 CWE-732