Red Hat Security Advisory: OpenShift Container Platform 4.7.0 packages security update

Fixed packages 21

Vulnerabilities 6

• High 8.6
  CVE-2021-3121

  Improper Input Validation in GoGo Protobuf

  An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

  k3d k3d-proxy k3d-tools ctop Debian Ubuntu Alpine Wolfi Go
  Jan 11, 2021
• High 7.5
  CVE-2020-25658

  Timing attacks in python-rsa

  It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.

  Sybren A. Stüvel python-rsa rsa python-rsa Debian Ubuntu PyPI
  Nov 12, 2020
• Medium 6.1
  CVE-2020-15157

  containerd can be coerced into leaking credentials during image pull

  In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific im…

  containerd containerd docker.io docker.io Debian Ubuntu Go
  Oct 16, 2020
• Medium 4.7
  CVE-2020-8566

  Ceph RBD adminSecrets exposed in logs when loglevel >= 4

  In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1…

  Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  Dec 7, 2020
• Low 3.6
  CVE-2019-3884

  A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a va…

  Red Hat atomic-openshift
  Aug 1, 2019
• Unscored —
  CVE-2020-28362

  Panic during division of very large numbers in math/big

  Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

  golang go stdlib golang-1.14 Debian Ubuntu Azure Linux Alpine Go
  Nov 18, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1693905
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1886640
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1888248
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1889972
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1910081
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1921650
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2020_5634.json
• report
  https://access.redhat.com/security/cve/CVE-2019-3884
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-3884
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-3884
• report
  https://access.redhat.com/security/cve/CVE-2020-8566
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8566
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8566
• article
  https://github.com/kubernetes/kubernetes/issues/95624
• article
  https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk
• report
  https://access.redhat.com/security/cve/CVE-2020-15157
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15157
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15157
• article
  https://github.com/containerd/containerd/releases/tag/v1.2.14
• article
  https://github.com/containerd/containerd/security/advisories/GHSA-742w-89gc-8m9c
• article
  https://www.openwall.com/lists/oss-security/2020/10/15/1
• report
  https://access.redhat.com/security/cve/CVE-2020-25658
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-25658
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-25658
• article
  https://github.com/sybrenstuvel/python-rsa/issues/165
• report
  https://access.redhat.com/security/cve/CVE-2020-28362
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1897635
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28362
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28362
• report
  https://access.redhat.com/security/cve/CVE-2021-3121
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3121
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3121