Red Hat Security Advisory: OpenShift Container Platform 3.10 atomic-openshift kube-apiserver security update

Fixed packages 14

Vulnerabilities 2

• Medium 6.4
  CVE-2019-10214

  containers/image library Insufficiently Protects Credentials

  The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker…

  singularity-container github.com/containers/image golang-github-containers-image Ubuntu Go
  Nov 25, 2019
• Medium 5.9
  CVE-2019-10150

  It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using…

  Red Hat atomic-openshift
  Jun 12, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1713433
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1732508
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2989.json
• report
  https://access.redhat.com/security/cve/CVE-2019-10150
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10150
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10150
• article
  https://docs.openshift.com/container-platform/3.11/dev_guide/builds/build_inputs.html#source-secrets-ssh-key-authentication
• report
  https://access.redhat.com/security/cve/CVE-2019-10214
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10214
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10214