Skip to content
OpenAdvisories
High RHSA-2021:1006 3 CVEs

Red Hat Security Advisory: OpenShift Container Platform 4.7.5 security and bug fix update

Published Sep 18, 2024 · Updated Aug 20, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · OpenShift 4 openshift:4.7::el7 cri-o 0:1.20.2-4.rhaos4.7.gitd5a999a.el7
Red Hat · OpenShift 4 openshift:4.7::el7 cri-o-debuginfo 0:1.20.2-4.rhaos4.7.gitd5a999a.el7
Red Hat · OpenShift 4 openshift:4.7::el7 openshift-clients 0:4.7.0-202103251046.p0.git.3957.c4da68b.el7
Red Hat · OpenShift 4 openshift:4.7::el7 openshift-clients-redistributable 0:4.7.0-202103251046.p0.git.3957.c4da68b.el7
Red Hat · OpenShift 4 openshift:4.7::el8 cri-o 0:1.20.2-4.rhaos4.7.gitd5a999a.el8
Red Hat · OpenShift 4 openshift:4.7::el8 cri-o-debuginfo 0:1.20.2-4.rhaos4.7.gitd5a999a.el8
Red Hat · OpenShift 4 openshift:4.7::el8 cri-o-debugsource 0:1.20.2-4.rhaos4.7.gitd5a999a.el8
Red Hat · OpenShift 4 openshift:4.7::el8 jenkins-2-plugins 0:4.7.1616671397-1.el8
Red Hat · OpenShift 4 openshift:4.7::el8 openshift-clients 0:4.7.0-202103251046.p0.git.3957.c4da68b.el8
Red Hat · OpenShift 4 openshift:4.7::el8 openshift-clients-redistributable 0:4.7.0-202103251046.p0.git.3957.c4da68b.el8

Vulnerabilities 3

  • High 8.6
    CVE-2021-3121

    Improper Input Validation in GoGo Protobuf

    An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

    k3d k3d-proxy k3d-tools ctop Debian Ubuntu Alpine Wolfi Go
  • High 7.4
    CVE-2021-20218

    Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client

    A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat fro…

    io.fabric8:kubernetes-client Maven
  • Unscored —
    CVE-2021-3114

    Incorrect operations on the P-224 curve in crypto/elliptic

    In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1921650
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1944016
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1006.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-3114
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1918750
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3114
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3114
  • article
    https://groups.google.com/g/golang-announce/c/mperVMGa98w
  • report
    https://access.redhat.com/security/cve/CVE-2021-3121
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3121
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3121
  • report
    https://access.redhat.com/security/cve/CVE-2021-20218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1923405
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-20218
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-20218
  • article
    https://github.com/fabric8io/kubernetes-client/issues/2715