Red Hat Security Advisory

RHSA-2020:2992

OpenShift Container Platform 3.11 security update

Released 2020-07-27 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.11 atomic-openshift-3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-clients-3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-clients-redistributable-3.11.248-1.git.0.92ee8ac.el7 +12

Fixes 6 records

TI-2020-06857 CVE-2020-8558 · GHSA-wqv3-8cm6-h6wg

Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

MEDIUM 44

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 runnin…

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.03418 Published 2020-07-27 Fixed in 1.18.4, 1.17.7 +1 CWE-420

TI-2020-07179 CVE-2020-8945 · GHSA-m6wg-2mwg-4rfq

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as…

MEDIUM 41

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.05071 Published 2020-02-12 Partial fix · 0.1.1 CWE-416

TI-2020-06120 CVE-2020-7598 · GHSA-vh95-rmgr-6w4m

Prototype pollution in minimist

LOW 35

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.01931 Published 2020-03-11 Partial fix · 0.2.1, 1.2.3 CWE-1321

TI-2020-06852 CVE-2020-8552 · GHSA-82hx-w2r5-c2wq

Kubernetes API server denial of service

LOW 29

The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02845 Published 2020-03-27 Partial fix · v1.17.3, v1.16.7 +4 CWE-789

TI-2019-11095 CVE-2019-14891 · GHSA-7hwv-gxwq-2g5p

Improper check for unusual conditions in cri-o

LOW 24

A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00796 Published 2019-11-25 Fixed CWE-460

TI-2020-08614 CVE-2020-10715 · GHSA-7p43-3rw5-j59j

Improper input validation in openshift/console

LOW 22

A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00946 Published 2020-09-16 Fixed CWE-20