Red Hat Security Advisory: OpenShift Container Platform 3.11.374 bug fix and security update

Fixed packages 33

Vulnerabilities 3

• Medium 6.5
  CVE-2020-26137

  CRLF injection in urllib3

  urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

  python-pip python-urllib3 urllib3 python-urllib3 Debian Ubuntu Alpine PyPI
  Sep 29, 2020
• Medium 6.3
  CVE-2020-8554 Public exploit

  Kubernetes man in the middle using LoadBalancer or ExternalIPs

  Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a pri…

  Kubernetes Kubernetes kubernetes-1.35 kubernetes Debian Azure Linux Wolfi Go
  Jan 21, 2021
• Medium 5.9
  CVE-2019-11840

  golang.org/x/crypto/salsa20/salsa uses insufficiently random values

  An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa package…

  k3d k3d-proxy k3d-tools snapd Debian Ubuntu Wolfi Go
  May 9, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1691529
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1866789
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1870050
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1881319
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1883632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1891051
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0079.json
• report
  https://access.redhat.com/security/cve/CVE-2019-11840
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11840
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11840
• article
  https://groups.google.com/forum/#!msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ
• report
  https://access.redhat.com/security/cve/CVE-2020-8554
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8554
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8554
• article
  https://blog.champtar.fr/K8S_MITM_LoadBalancer_ExternalIPs/
• article
  https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8
• report
  https://access.redhat.com/security/cve/CVE-2020-26137
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26137
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26137