Skip to content
OpenAdvisories
Medium RHBA-2020:4197 3 CVEs

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.6 GA RPMs

Published Sep 29, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · OpenShift 4 openshift:4.6::el7 openshift 0:4.6.0-202010022112.p0.git.94033.ef41184.el7
Red Hat · OpenShift 4 openshift:4.6::el7 openshift-hyperkube 0:4.6.0-202010022112.p0.git.94033.ef41184.el7
Red Hat · OpenShift 4 openshift:4.6::el8 ignition 0:2.6.0-5.rhaos4.6.git947598e.el8
Red Hat · OpenShift 4 openshift:4.6::el8 ignition-debuginfo 0:2.6.0-5.rhaos4.6.git947598e.el8
Red Hat · OpenShift 4 openshift:4.6::el8 ignition-debugsource 0:2.6.0-5.rhaos4.6.git947598e.el8
Red Hat · OpenShift 4 openshift:4.6::el8 ignition-validate 0:2.6.0-5.rhaos4.6.git947598e.el8
Red Hat · OpenShift 4 openshift:4.6::el8 ignition-validate-debuginfo 0:2.6.0-5.rhaos4.6.git947598e.el8
Red Hat · OpenShift 4 openshift:4.6::el8 openshift 0:4.6.0-202010022112.p0.git.94033.ef41184.el8
Red Hat · OpenShift 4 openshift:4.6::el8 openshift-hyperkube 0:4.6.0-202010022112.p0.git.94033.ef41184.el8

Vulnerabilities 3

  • Medium 6.4
    CVE-2020-8559 Public exploit

    Privilege escalation from compromised node to cluster

    The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a ful…

    Kubernetes Kubernetes zot kots Debian Alpine Wolfi Go
  • Unscored —
    CVE-2020-15586

    Data race and crash in net/http

    Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2020-16845

    Unbounded read from invalid inputs in encoding/binary

    Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1834410
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_4197.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-8559
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1851422
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8559
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-8559
  • article
    https://groups.google.com/g/kubernetes-security-announce/c/JAIGG5yNROs
  • report
    https://access.redhat.com/security/cve/CVE-2020-15586
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1856953
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-15586
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-15586
  • article
    https://groups.google.com/g/golang-announce/c/XZNfaiwgt2w/m/E6gHDs32AQAJ
  • report
    https://access.redhat.com/security/cve/CVE-2020-16845
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1867099
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-16845
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-16845
  • article
    https://groups.google.com/g/golang-announce/c/NyPIaucMgXo