Red Hat Security Advisory: Red Hat OpenShift Serverless Client kn 1.12.0

Fixed packages 1

Vulnerabilities 4

• Unscored —
  CVE-2020-24553

  Cross-site scripting in net/http/cgi and net/http/fcgi

  Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Sep 2, 2020
• Unscored —
  CVE-2020-28362

  Panic during division of very large numbers in math/big

  Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

  golang go stdlib golang-1.14 Debian Ubuntu Azure Linux Alpine Go
  Nov 18, 2020
• Unscored —
  CVE-2020-28366

  Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

  Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

  Go toolchain cmd/go cmd/cgo go Debian Ubuntu Azure Linux Alpine Go
  Nov 18, 2020
• Unscored —
  CVE-2020-28367

  Arbitrary code execution via the go command with cgo in cmd/go

  Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

  Go toolchain cmd/go go golang-1.8 Debian Ubuntu Alpine Go
  Nov 18, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless_applications/installing-openshift-serverless-1#installing-kn
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1874857
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1897635
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1897643
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1897646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1906386
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0145.json
• report
  https://access.redhat.com/security/cve/CVE-2020-24553
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-24553
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-24553
• article
  https://groups.google.com/forum/#!topic/golang-announce/8wqlSbkLdPs
• article
  https://www.redteam-pentesting.de/en/advisories/rt-sa-2020-004/-inconsistent-behavior-of-gos-cgi-and-fastcgi-transport-may-lead-to-cross-site-scripting
• report
  https://access.redhat.com/security/cve/CVE-2020-28362
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28362
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28362
• report
  https://access.redhat.com/security/cve/CVE-2020-28366
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28366
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28366
• article
  https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM/m/fLguyiM2CAAJ
• report
  https://access.redhat.com/security/cve/CVE-2020-28367
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28367
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28367