Description
A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, able to man-in-the-middle the connection between the user's browser and the openshift console, could use this flaw to perform a phishing attack. The main threat from this vulnerability is data confidentiality.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | openshift-ansible | openshift-ansible-3.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | jenkins | 2.235.2.1597220898-1.el7 | RHSA-2020:3541 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1597310986-1.el7 | RHSA-2020:3541 |
| Red Hat OpenShift 3 | openshift-ansible +4 | 3.11.272-1.git.0.79ab6e9.el7 | RHSA-2020:3541 |
| Red Hat OpenShift 3 | python-rsa +1 | 4.5-2.el7 | RHSA-2020:3541 |
Advisories 1
- RHSA-2020:3541 Red Hat Security Advisory: OpenShift Container Platform 3.11 security update Red Hat Security Advisories (RHSA) · Aug 8, 2026