Red Hat Security Advisory: OpenShift Container Platform 3.7 security update

Fixed packages 24

Vulnerabilities 2

• Critical 9.8
  CVE-2018-1002105 Public exploit EPSS 87%

  Privilege Escalation in Kubernetes

  In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backe…

  Kubernetes Kubernetes kubernetes github.com/kubernetes/kubernetes Debian Go
  Dec 5, 2018
• High 7.7
  CVE-2018-14632

  JSON-Patch Out-of-bounds Write vulnerability

  An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before 3.7. An attacker can use this flaw to cause a denial of service attack on the Openshift master api service which provid…

  Red Hat atomic-openshift github.com/evanphx/json-patch golang-github-evanphx-json-patch Ubuntu Go
  Sep 6, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://access.redhat.com/security/vulnerabilities/3716411
• article
  https://docs.openshift.com/container-platform/3.7/release_notes/ocp_3_7_release_notes.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1585767
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1616150
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1620817
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1622336
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625885
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1648138
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2906.json
• report
  https://access.redhat.com/security/cve/CVE-2018-14632
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-14632
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-14632
• report
  https://access.redhat.com/security/cve/CVE-2018-1002105
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1002105
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1002105
• article
  https://groups.google.com/forum/#!topic/kubernetes-announce/GVllWCg6L88