Red Hat Security Advisory: OpenShift Container Platform 4.7.11 security and bug fix update

Fixed packages 11

Vulnerabilities 6

• High 7.5
  CVE-2021-28165 Public exploit EPSS 54%

  Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

  In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

  The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  Apr 1, 2021
• Medium 4.3
  CVE-2021-21639

  Lack of type validation in agent related REST API in Jenkins

  Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one …

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Apr 7, 2021
• Medium 4.3
  CVE-2021-21640

  View name validation bypass in Jenkins

  Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Apr 7, 2021
• Low 2.7
  CVE-2021-28163

  Directory exposure in jetty

  In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and…

  The Eclipse Foundation Eclipse Jetty jetty9 equinox-bundles Debian Ubuntu Maven
  Apr 1, 2021
• Unscored —
  CVE-2020-28362

  Panic during division of very large numbers in math/big

  Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

  golang go stdlib golang-1.14 Debian Ubuntu Azure Linux Alpine Go
  Nov 18, 2020
• Unscored —
  CVE-2021-3114

  Incorrect operations on the P-224 curve in crypto/elliptic

  In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Jan 26, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1897635
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1918750
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1945710
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1945714
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1959660
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1551.json
• report
  https://access.redhat.com/security/cve/CVE-2020-28362
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28362
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28362
• report
  https://access.redhat.com/security/cve/CVE-2021-3114
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3114
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3114
• article
  https://groups.google.com/g/golang-announce/c/mperVMGa98w
• report
  https://access.redhat.com/security/cve/CVE-2021-21639
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1947102
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21639
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21639
• report
  https://access.redhat.com/security/cve/CVE-2021-21640
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1947105
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21640
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21640
• report
  https://access.redhat.com/security/cve/CVE-2021-28163
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-28163
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-28163
• article
  https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq
• report
  https://access.redhat.com/security/cve/CVE-2021-28165
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-28165
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-28165
• article
  https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w