Red Hat Security Advisory: OpenShift Container Platform 4.4.13 machine-config-daemon and openshift security update

Fixed packages 5

Vulnerabilities 2

• High 7.5
  CVE-2020-8945

  GPGME Go wrapper contains Use After Free

  The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

  singularity-container golang-github-proglottis-gpgme github.com/proglottis/gpgme golang-github-proglottis-gpgme Debian Ubuntu Go
  Feb 12, 2020
• Medium 5.4
  CVE-2020-8558 Public exploit

  Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

  The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network …

  Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  Jul 27, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1795838
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1843358
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2927.json
• report
  https://access.redhat.com/security/cve/CVE-2020-8558
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8558
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8558
• article
  https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE
• report
  https://access.redhat.com/security/cve/CVE-2020-8945
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8945
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8945