Skip to content
OpenAdvisories
High ELSA-2021-9029 2 CVEs

Important: olcne security update (Oracle Linux 7)

Published Feb 10, 2021 · Updated Feb 10, 2021

Ecosystem: Oracle Linux

Summary

kata-runtime
[1.7.3-1.0.7]
- Address CVE-2020-28914

kata
[1.7.3-1.0.12]
- UEKR6 guest kernel support

[1.7.3-1.0.11]
- Address CVE-2020-28914

kubernetes
[1.17.9-1.0.6]
- Kata CVE-2020-28914

olcne
[1.1.10-1]
- Address CVE-2020-28914: An improper file permissions vulnerability affects Kata Containers prior to 1.11.5

[1.1.9-1]
- Enhance the Kubernetes module to restrict the usage of external IPs
- Address CVE-2020-8554: man-in-the-middle vulnerability using Kubernetes service External IPs

Fixed packages 12

ReleasePackageFixed in
Oracle Linux · 7 kata 0:1.7.3-1.0.12.el7
Oracle Linux · 7 kata-runtime 0:1.7.3-1.0.7.el7
Oracle Linux · 7 kubeadm 0:1.17.9-1.0.6.el7
Oracle Linux · 7 kubectl 0:1.17.9-1.0.6.el7
Oracle Linux · 7 kubelet 0:1.17.9-1.0.6.el7
Oracle Linux · 7 olcne-agent 0:1.1.10-1.el7
Oracle Linux · 7 olcne-api-server 0:1.1.10-1.el7
Oracle Linux · 7 olcne-istio-chart 0:1.1.10-1.el7
Oracle Linux · 7 olcne-nginx 0:1.1.10-1.el7
Oracle Linux · 7 olcne-prometheus-chart 0:1.1.10-1.el7
Oracle Linux · 7 olcne-utils 0:1.1.10-1.el7
Oracle Linux · 7 olcnectl 0:1.1.10-1.el7

Vulnerabilities 2

  • Medium 6.3
    CVE-2020-8554 Public exploit

    Kubernetes man in the middle using LoadBalancer or ExternalIPs

    Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a pri…

    Kubernetes Kubernetes kubernetes-1.35 kubernetes Debian Azure Linux Wolfi Go
  • Unscored —
    CVE-2020-28914

    An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath vo…