Red Hat Security Advisory

RHSA-2020:2413

OpenShift Container Platform 4.5 package security update

Released 2020-07-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.5 machine-config-daemon-4.5.0-202007012112.p0.git.2527.d12c3da.el8, openshift-4.5.0-202007012112.p0.git.0.582d7fc.el7, openshift-4.5.0-202007012112.p0.git.0.582d7fc.el8 +2

Fixes 5 records

TI-2020-07424 CVE-2020-9283 · GHSA-ffhg-7mh4-33c4

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic…

MEDIUM 52

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.21052 Published 2020-02-20 Partial fix · 0.0.0-20200220183623-bac4c82f6975 CWE-347

TI-2020-06857 CVE-2020-8558 · GHSA-wqv3-8cm6-h6wg

Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

MEDIUM 44

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 runnin…

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.03418 Published 2020-07-27 Fixed in 1.18.4, 1.17.7 +1 CWE-420

TI-2020-07179 CVE-2020-8945 · GHSA-m6wg-2mwg-4rfq

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as…

MEDIUM 41

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.05071 Published 2020-02-12 Partial fix · 0.1.1 CWE-416

TI-2019-08424 CVE-2019-11254 · GHSA-wxc4-f4m6-wwqv

Kubernetes API Server denial of service vulnerability from malicious YAML payloads

LOW 35

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03157 Published 2020-04-01 Partial fix · 1.15.10, 1.16.7 +2 CWE-1050

TI-2019-08422 CVE-2019-11252

Credential leakage when failing to mount

LOW 31

The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00967 Published 2020-07-23 Partial fix CWE-209