Red Hat Security Advisory

RHSA-2021:0281

OpenShift Container Platform 4.4.33 bug fix and security update

Released 2021-02-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.4 openshift4/ose-aws-machine-controllers, openshift4/ose-azure-machine-controllers, openshift4/ose-baremetal-machine-controllers +47

Fixes 3 records

TI-2021-03482 CVE-2021-20182

A privilege escalation flaw was found in openshift4/ose-docker-builder.

MEDIUM 40

A privilege escalation flaw was found in openshift4/ose-docker-builder.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01145 Published 2021-02-23 Fixed CWE-552

TI-2020-06858 CVE-2020-8559 · GHSA-33c5-9fx5-fvjm

Privilege escalation from compromised node to cluster

LOW 39

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate pri…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.061 Published 2020-07-22 Fixed in 0.16.13, 0.17.9 +4 CWE-601

TI-2020-06862 CVE-2020-8564 · GHSA-8mjg-8c8g-6h85

Docker config secrets leaked when file is malformed and loglevel >= 4

LOW 25

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry c…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00467 Published 2020-12-07 Fixed in 1.19.3, 1.18.10 +2 CWE-532