Skip to content
OpenAdvisories
Medium RHSA-2019:3266 1 CVE

Red Hat Security Advisory: OpenShift Container Platform 4.1 openshift security update

Published Sep 16, 2024 · Updated Jan 14, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · OpenShift 4 openshift:4.1::el7 openshift 0:4.1.21-201910220952.git.0.493dbf6.el7
Red Hat · OpenShift 4 openshift:4.1::el7 openshift-clients 0:4.1.21-201910220952.git.0.493dbf6.el7
Red Hat · OpenShift 4 openshift:4.1::el7 openshift-clients-redistributable 0:4.1.21-201910220952.git.0.493dbf6.el7
Red Hat · OpenShift 4 openshift:4.1::el7 openshift-hyperkube 0:4.1.21-201910220952.git.0.493dbf6.el7
Red Hat · OpenShift 4 openshift:4.1::el8 openshift 0:4.1.21-201910220952.git.0.493dbf6.el8
Red Hat · OpenShift 4 openshift:4.1::el8 openshift-clients 0:4.1.21-201910220952.git.0.493dbf6.el8
Red Hat · OpenShift 4 openshift:4.1::el8 openshift-clients-redistributable 0:4.1.21-201910220952.git.0.493dbf6.el8
Red Hat · OpenShift 4 openshift:4.1::el8 openshift-hyperkube 0:4.1.21-201910220952.git.0.493dbf6.el8

Vulnerabilities 1

  • Medium 4.8
    CVE-2019-11251

    kubectl cp allows symlink directory traversal

    The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in th…

    Kubernetes Kubernetes k8s.io/kubernetes Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1753495
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3266.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-11251
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-11251
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-11251
  • article
    https://groups.google.com/forum/#!msg/kubernetes-announce/YYtEFdFimZ4/nZnOezZuBgAJ