Red Hat Security Advisory: Red Hat OpenShift Container Storage 4.7 RPM security, bug fix, and enhancement update

Fixed packages 1

Vulnerabilities 2

• High 7.5
  CVE-2020-26160 Public exploit

  Authorization bypass in github.com/dgrijalva/jwt-go

  jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if th…

  gitness dgraph docker-credential-acr-env gitea Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 30, 2020
• Unscored —
  CVE-2020-28362

  Panic during division of very large numbers in math/big

  Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

  golang go stdlib golang-1.14 Debian Ubuntu Azure Linux Alpine Go
  Nov 18, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1883371
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1897635
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1941502
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2042.json
• report
  https://access.redhat.com/security/cve/CVE-2020-26160
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26160
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26160
• article
  https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
• report
  https://access.redhat.com/security/cve/CVE-2020-28362
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28362
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28362