Red Hat Security Advisory: OpenShift Container Platform 4.8.2 packages and security update

Fixed packages 180

Vulnerabilities 26

• High 8.6
  CVE-2021-3121

  Improper Input Validation in GoGo Protobuf

  An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

  k3d k3d-proxy k3d-tools ctop Debian Ubuntu Alpine Wolfi Go
  Jan 11, 2021
• High 8.1
  CVE-2021-21642 EPSS 38%

  XML External Entity Reference vulnerability in Jenkins Config File Provider Plugin

  Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Apr 21, 2021
• High 8.0
  CVE-2021-21604

  Improper handling of REST API XML deserialization errors in Jenkins

  Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an adm…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jan 13, 2021
• High 8.0
  CVE-2021-21605

  Path traversal vulnerability in Jenkins agent names

  Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jan 13, 2021
• High 7.6
  CVE-2021-30465 EPSS 10%

  mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs

  runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange a…

  buildah runc github.com/opencontainers/runc k3s Debian Ubuntu Azure Linux Alpine Go
  May 27, 2021
• Medium 6.5
  CVE-2021-20291

  Improper Locking in github.com/containers/storage

  A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an un…

  buildah golang-github-containers-storage golang-github-containers-storage github.com/containers/storage Debian Ubuntu Azure Linux Go
  Apr 1, 2021
• Medium 6.5
  CVE-2021-21602

  Arbitrary file read vulnerability in workspace browsers in Jenkins

  Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jan 13, 2021
• Medium 6.5
  CVE-2021-21607

  Excessive memory allocation in graph URLs leads to denial of service in Jenkins

  Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jan 13, 2021
• Medium 6.5
  CVE-2021-21623

  Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items

  An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.

  Jenkins Project Jenkins Matrix Authorization Strategy Plugin org.jenkins-ci.plugins:matrix-auth Web / CMS Maven
  Mar 18, 2021
• Medium 6.5
  CVE-2021-21643

  Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs

  Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Apr 21, 2021
• Medium 6.5
  CVE-2021-25735 Public exploit

  Validating Admission Webhook does not observe some previous fields

  A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at leas…

  Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Alpine Go
  Sep 6, 2021
• Medium 6.1
  CVE-2021-21610

  Reflected XSS vulnerability in Jenkins markup formatter preview

  Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup …

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jan 13, 2021
• Medium 6.1
  CVE-2021-21648 EPSS 11%

  Cross-Site Request Forgery in Jenkins Credentials Plugin

  Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.

  Jenkins Project Jenkins Credentials Plugin org.jenkins-ci.plugins:credentials Web / CMS Maven
  May 11, 2021
• Medium 5.4
  CVE-2021-21603

  XSS vulnerability in Jenkins notification bar

  Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jan 13, 2021
• Medium 5.4
  CVE-2021-21608

  Stored XSS vulnerability in Jenkins button labels

  Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jan 13, 2021
• Medium 5.4
  CVE-2021-21611

  Stored XSS vulnerability in Jenkins on new item page

  Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of …

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jan 13, 2021
• Medium 5.4
  CVE-2021-21644

  CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files

  A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Apr 21, 2021
• Medium 5.3
  CVE-2021-21419

  Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet

  Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version…

  eventlet eventlet eventlet python-eventlet Debian Ubuntu PyPI
  May 7, 2021
• Medium 5.3
  CVE-2021-21609

  Missing permission check for paths with specific prefix in Jenkins

  Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jan 13, 2021
• Medium 4.3
  CVE-2021-21606

  Arbitrary file existence check in file fingerprints in Jenkins

  Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Jan 13, 2021
• Medium 4.3
  CVE-2021-21639

  Lack of type validation in agent related REST API in Jenkins

  Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one …

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Apr 7, 2021
• Medium 4.3
  CVE-2021-21640

  View name validation bypass in Jenkins

  Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven
  Apr 7, 2021
• Medium 4.3
  CVE-2021-21645

  Missing permission checks in Jenkins Config File Provider Plugin allow enumerating configuration file IDs

  Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Apr 21, 2021
• Low 2.7
  CVE-2021-25737

  Holes in EndpointSlice Validation Enable Host Network Hijack

  A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed …

  Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  Sep 6, 2021
• Unscored —
  CVE-2021-3114

  Incorrect operations on the P-224 curve in crypto/elliptic

  In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Jan 26, 2021
• Unscored —
  CVE-2021-3636

  It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectl…

  Jul 30, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1918750
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1921650
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1937562
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1940489
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1947102
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1947105
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954917
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1958407
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1959545
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1978621
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2437.json
• report
  https://access.redhat.com/security/cve/CVE-2021-3114
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3114
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3114
• article
  https://groups.google.com/g/golang-announce/c/mperVMGa98w
• report
  https://access.redhat.com/security/cve/CVE-2021-3121
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3121
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3121
• report
  https://access.redhat.com/security/cve/CVE-2021-3636
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3636
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3636
• report
  https://access.redhat.com/security/cve/CVE-2021-20291
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1939485
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20291
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20291
• article
  https://unit42.paloaltonetworks.com/cve-2021-20291/
• report
  https://access.redhat.com/security/cve/CVE-2021-21419
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21419
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21419
• report
  https://access.redhat.com/security/cve/CVE-2021-21602
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1925161
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21602
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21602
• report
  https://access.redhat.com/security/cve/CVE-2021-21603
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1925160
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-21603
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-21603
• report
  https://access.redhat.com/security/cve/CVE-2021-21604