Red Hat Security Advisory: OpenShift Container Platform 3.11 security update

Fixed packages 16

Vulnerabilities 6

• High 7.5
  CVE-2020-8945

  GPGME Go wrapper contains Use After Free

  The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

  singularity-container golang-github-proglottis-gpgme github.com/proglottis/gpgme golang-github-proglottis-gpgme Debian Ubuntu Go
  Feb 12, 2020
• Medium 5.6
  CVE-2020-7598 Public exploit

  Prototype Pollution in minimist

  minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

  js-jquery nodejs-nodemon minimist node-minimist Debian Ubuntu Azure Linux npm
  Mar 11, 2020
• Medium 5.4
  CVE-2020-8558 Public exploit

  Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

  The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network …

  Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  Jul 27, 2020
• Medium 5.3
  CVE-2020-8552

  Kubernetes API server denial of service

  The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.

  Kubernetes Kubernetes kubernetes k8s.io/apiserver Debian Go
  Mar 27, 2020
• Medium 5.0
  CVE-2019-14891

  A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can re…

  Nov 25, 2019
• Unscored —
  CVE-2020-10715

  A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft…

  Sep 16, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1767665
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1772280
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1795838
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797909
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1813344
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1843358
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2992.json
• report
  https://access.redhat.com/security/cve/CVE-2019-14891
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-14891
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-14891
• article
  https://capsule8.com/blog/oomypod-nothin-to-cri-o-bout/
• report
  https://access.redhat.com/security/cve/CVE-2020-7598
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7598
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7598
• article
  https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
• report
  https://access.redhat.com/security/cve/CVE-2020-8552
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8552
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8552
• article
  https://github.com/kubernetes/kubernetes/issues/89378
• article
  https://groups.google.com/forum/#!topic/kubernetes-security-announce/2UOlsba2g0s
• report
  https://access.redhat.com/security/cve/CVE-2020-8558
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8558
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8558
• article
  https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE
• report
  https://access.redhat.com/security/cve/CVE-2020-8945
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8945
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8945
• report
  https://access.redhat.com/security/cve/CVE-2020-10715
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-10715
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-10715