Red Hat Security Advisory

RHSA-2020:5363

OpenShift Container Platform 3.11.346 security and bug fix update

Released 2020-12-16 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.11 atomic-openshift-3.11.346-1.git.0.ea10721.el7, atomic-openshift-clients-3.11.346-1.git.0.ea10721.el7, atomic-openshift-clients-redistributable-3.11.346-1.git.0.ea10721.el7 +10

Fixes 2 records

TI-2020-06858 CVE-2020-8559 · GHSA-33c5-9fx5-fvjm

Privilege escalation from compromised node to cluster

LOW 39

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate pri…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.061 Published 2020-07-22 Fixed in 0.16.13, 0.17.9 +4 CWE-601

TI-2018-16127 CVE-2018-1002102

Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints

LOW 14

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts.

CVSS 3.1LOW 2.6 Network High privileges User interaction EPSS 0.00618 Published 2019-12-05 Fixed in v1.14.0 CWE-601