Description
A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is able to delete children of those objects. Versions 3.6, 3.7, 3.8, 3.9, 3.10, 3.11 and 4.1 are affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | atomic-openshift | 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 4.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.20.0-0.rhaos4.7.git8921e00.el7.51 | RHSA-2020:5634 |
| Red Hat OpenShift 4 | cri-tools | 1.18.0-3.el7 | RHSA-2020:5634 |
| Red Hat OpenShift 4 | ignition +1 | 2.9.0-2.rhaos4.7.git1d56dc8.el8 | RHSA-2020:5634 |
| Red Hat OpenShift 4 | openshift +1 | 4.7.0-202102060108.p0.git.97095.7271b90.el7 | RHSA-2020:5634 |
| Red Hat OpenShift 4 | python-rsa +1 | 4.7-1.el8 | RHSA-2020:5634 |
Advisories 1
- RHSA-2020:5634 Red Hat Security Advisory: OpenShift Container Platform 4.7.0 packages security update Red Hat Security Advisories (RHSA) · Oct 13, 2026