Red Hat Security AdvisoryRHSA-2021:0079
OpenShift Container Platform 3.11.374 bug fix and security update
Released 2021-01-20 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 3.11 atomic-enterprise-service-catalog-1:3.11.374-1.git.1675.738abcc.el7, atomic-enterprise-service-catalog-svcat-1:3.11.374-1.git.1675.738abcc.el7, atomic-openshift-3.11.374-1.git.0.ebd3ee9.el7 +30
Fixes 3 records
Priority LOW 39
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.08721 · Published 2021-01-21 · Fixed CWE-283
Priority LOW 33
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest().
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.02269 · Published 2020-09-29 · Partial fix · 1.25.9 CWE-74
Priority LOW 33
An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.03452 · Published 2019-05-09 · Partial fix · 0.0.0-20190320223903-b7391e95e576 CWE-330
THREATIST.IORead the docs