Skip to content
OpenAdvisories
High RHSA-2020:2413 5 CVEs

Red Hat Security Advisory: OpenShift Container Platform 4.5 package security update

Published Sep 30, 2024 · Updated Oct 19, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · OpenShift 4 openshift:4.5::el7 openshift 0:4.5.0-202007012112.p0.git.0.582d7fc.el7
Red Hat · OpenShift 4 openshift:4.5::el7 openshift-hyperkube 0:4.5.0-202007012112.p0.git.0.582d7fc.el7
Red Hat · OpenShift 4 openshift:4.5::el8 machine-config-daemon 0:4.5.0-202007012112.p0.git.2527.d12c3da.el8
Red Hat · OpenShift 4 openshift:4.5::el8 openshift 0:4.5.0-202007012112.p0.git.0.582d7fc.el8
Red Hat · OpenShift 4 openshift:4.5::el8 openshift-hyperkube 0:4.5.0-202007012112.p0.git.0.582d7fc.el8

Vulnerabilities 5

  • High 7.5
    CVE-2020-8945

    GPGME Go wrapper contains Use After Free

    The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

    singularity-container github.com/proglottis/gpgme golang-github-proglottis-gpgme golang-github-proglottis-gpgme Debian Ubuntu Go
  • High 7.5
    CVE-2020-9283 Public exploit EPSS 21%

    Improper Verification of Cryptographic Signature in golang.org/x/crypto

    golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

    k3d k3d-proxy k3d-tools golang.org/x/crypto Debian Ubuntu Wolfi Go
  • Medium 6.5
    CVE-2019-11254

    Kubernetes API Server denial of service vulnerability from malicious YAML payloads

    The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

    Kubernetes Kubernetes k3d k3d-proxy Debian Azure Linux Wolfi Go
  • Medium 5.9
    CVE-2019-11252

    Credential leakage when failing to mount

    The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.

    Kubernetes Kubernetes kubernetes Debian
  • Medium 5.4
    CVE-2020-8558 Public exploit

    Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

    The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network …

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1795838
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1819486
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1843358
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2413.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-11252
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1860158
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-11252
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-11252
  • report
    https://access.redhat.com/security/cve/CVE-2019-11254
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-11254
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-11254
  • article
    https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
  • report
    https://access.redhat.com/security/cve/CVE-2020-8558
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8558
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-8558
  • article
    https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE
  • report
    https://access.redhat.com/security/cve/CVE-2020-8945
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8945
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-8945
  • report
    https://access.redhat.com/security/cve/CVE-2020-9283
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1804533
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-9283
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-9283
  • article
    https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY