Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update

Fixed packages 13

Vulnerabilities 3

• Medium 6.5
  CVE-2019-11254

  Kubernetes API Server denial of service vulnerability from malicious YAML payloads

  The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

  Kubernetes Kubernetes k3d k3d-proxy Debian Azure Linux Wolfi Go
  Apr 1, 2020
• Medium 6.3
  CVE-2020-8555

  Kubernetes kube-controller-manager SSRF

  The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary in…

  Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Alpine Go
  Jun 4, 2020
• Medium 4.8
  CVE-2017-18367

  Improper Input Validation in libseccomp-golang

  libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by spec…

  github.com/seccomp/libseccomp-golang golang-github-seccomp-libseccomp-golang golang-github-seccomp-libseccomp-golang Debian Ubuntu Go
  Apr 24, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1706826
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819486
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1821583
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2479.json
• report
  https://access.redhat.com/security/cve/CVE-2017-18367
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-18367
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-18367
• report
  https://access.redhat.com/security/cve/CVE-2019-11254
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11254
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11254
• article
  https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
• report
  https://access.redhat.com/security/cve/CVE-2020-8555
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8555
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8555
• article
  https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30