Description
A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11. An attacker could use this flaw to steal authorization data by getting them to click on a malicious link.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | atomic-openshift | openshift-online-3, openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.11.188-1.git.0.db0eaa8.el7 | RHSA-2020:0795 |
Advisories 1
- RHSA-2020:0795 Red Hat Security Advisory: OpenShift Container Platform 3.11 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3889
- RHSA-2019:3722 vendor-advisory
- RHSA-2019:3770 vendor-advisory