Red Hat Security Advisory

RHSA-2021:3758

OpenShift Container Platform 4.9.0 packages and security update

Released 2021-10-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.9 coreos-installer-0.10.0-2.rhaos4.9.el8, coreos-installer-bootinfra-0.10.0-2.rhaos4.9.el8, jenkins-2.289.3.1630554997-1.el8 +10

Fixes 5 records

TI-2021-09398 CVE-2021-28169 · GHSA-gwcr-j4wh-j3cq

Information disclosure in Eclipse Jetty

MEDIUM 64

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.7848 Published 2021-06-09 Partial fix · 9.4.41, 10.0.3 +1 CWE-200

TI-2021-12744 CVE-2021-33196 · GHSA-6r28-26q2-vxwj

In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an…

LOW 39

In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03464 Published 2021-08-02 Partial fix CWE-20

TI-2021-15055 CVE-2021-36980 · GHSA-ww48-mfpv-wc3r

Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in…

LOW 27

Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.0118 Published 2021-07-20 Partial fix CWE-416

TI-2021-02826 CVE-2021-3917 · GHSA-862g-9h5m-m3qv

Incorrect default permissions in coreos-installer

LOW 24

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00235 Published 2022-08-23 Partial fix · 0.10.0 CWE-276

TI-2021-13462 CVE-2021-34428 · GHSA-m6cp-vxjx-65j6

Insufficient session expiration in Eclipse Jetty

LOW 19

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager.

CVSS 3.1LOW 3.5 Physical No auth No interaction EPSS 0.00963 Published 2021-06-22 Partial fix · 9.4.41, 10.0.3 +1 CWE-613