Skip to content
OpenAdvisories
High ELSA-2020-5726 3 CVEs

Important: grafana kubernetes-cni kubernetes-cni-plugins kubernetes kubernetes olcne security update (Oracle Linux 7)

Published Jun 12, 2020 · Updated Jun 12, 2020

Ecosystem: Oracle Linux

Summary

grafana
[%{}-1.0.1]
- Added Oracle Specific Build Files for grafana

kubernetes-cni
[0.7.1-1.0.1]
- Added Oracle specific build files for Kubernetes CNI

kubernetes-cni-plugins
[0.8.6-1.0.1]
- Added Oracle specific build files for Kubernetes CNI Plugins

kubernetes
[1.14.9-1.0.4]
- CVE-2020-10749: IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisements
- CVE-2020-8555: Half-Blind SSRF in kube-controller-manager

[1.14.9-1.0.3]
- [CVE-2019-11254] kube-apiserver Denial of Service vulnerability from malicious YAML payloads

[1.14.9-1.0.2]
- Use bounded crio version

[1.14.9-1.0.1]
- Added Oracle specific build files for Kubernetes

kubernetes
[1.17.6-1.0.2.el7]
- Update to kubernetes-cni for CVE-2020-10749

[1.17.6-1.0.2.el7]
- Added Oracle specific build files for Kubernetes

olcne
[1.1.1-1]
- Update Istio to use Grafana 6.7.4 to address CVE-2020-13379
- Kubernetes update due to CVE-2020-10749 and CVE-2020-8555

Fixed packages 13

ReleasePackageFixed in
Oracle Linux · 7 grafana 0:6.7.4-1.0.1.el7
Oracle Linux · 7 kubeadm 0:1.17.6-1.0.2.el7
Oracle Linux · 7 kubectl 0:1.17.6-1.0.2.el7
Oracle Linux · 7 kubelet 0:1.17.6-1.0.2.el7
Oracle Linux · 7 kubernetes-cni 0:0.7.1-1.0.1.el7
Oracle Linux · 7 kubernetes-cni-plugins 0:0.8.6-1.0.2.el7
Oracle Linux · 7 olcne-agent 0:1.1.1-3.el7
Oracle Linux · 7 olcne-api-server 0:1.1.1-3.el7
Oracle Linux · 7 olcne-istio-chart 0:1.1.1-3.el7
Oracle Linux · 7 olcne-nginx 0:1.1.1-3.el7
Oracle Linux · 7 olcne-prometheus-chart 0:1.1.1-3.el7
Oracle Linux · 7 olcne-utils 0:1.1.1-3.el7
Oracle Linux · 7 olcnectl 0:1.1.1-3.el7

Vulnerabilities 3

  • Medium 6.3
    CVE-2020-8555

    Kubernetes kube-controller-manager SSRF

    The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary in…

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Alpine Go
  • Medium 6.0
    CVE-2020-10749 Public exploit

    containernetworking/plugins vulnerable to MitM attacks

    A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IP…

    Red Hat containernetworking/plugins k3s golang-github-containernetworking-plugins Debian Ubuntu Alpine Go
  • Medium 5.8
    CVE-2020-13379 Public exploit Scanner template EPSS 100%

    Server Side Request Forgery in Grafana

    The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to…

    github.com/grafana/grafana grafana Alpine Go