Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-11253
Vulnerability from cvelistv5
Published
2019-10-17 15:40
Modified
2024-09-16 23:21
Severity ?
EPSS score ?
Summary
Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.
References
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Kubernetes | Kubernetes |
Version: prior to 1.13.12 Version: prior to 1.14.8 Version: prior to 1.15.5 Version: prior to 1.16.2 Version: 1.1 Version: 1.2 Version: 1.3 Version: 1.4 Version: 1.5 Version: 1.6 Version: 1.7 Version: 1.8 Version: 1.9 Version: 1.10 Version: 1.11 Version: 1.12 |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T22:48:09.095Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/kubernetes/kubernetes/issues/83253" }, { "name": "CVE-2019-11253: denial of service vulnerability from malicious YAML or JSON payloads", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://groups.google.com/forum/#%21topic/kubernetes-security-announce/jk8polzSUxs" }, { "name": "RHSA-2019:3239", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:3239" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20191031-0006/" }, { "name": "RHSA-2019:3811", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:3811" }, { "name": "RHSA-2019:3905", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:3905" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Kubernetes", "vendor": "Kubernetes", "versions": [ { "status": "affected", "version": "prior to 1.13.12" }, { "status": "affected", "version": "prior to 1.14.8" }, { "status": "affected", "version": "prior to 1.15.5" }, { "status": "affected", "version": "prior to 1.16.2" }, { "status": "affected", "version": "1.1" }, { "status": "affected", "version": "1.2" }, { "status": "affected", "version": "1.3" }, { "status": "affected", "version": "1.4" }, { "status": "affected", "version": "1.5" }, { "status": "affected", "version": "1.6" }, { "status": "affected", "version": "1.7" }, { "status": "affected", "version": "1.8" }, { "status": "affected", "version": "1.9" }, { "status": "affected", "version": "1.10" }, { "status": "affected", "version": "1.11" }, { "status": "affected", "version": "1.12" } ] } ], "credits": [ { "lang": "en", "value": "Rory McCune" } ], "datePublic": "2019-09-27T00:00:00", "descriptions": [ { "lang": "en", "value": "Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2019-11-18T20:06:59", "orgId": "a6081bf6-c852-4425-ad4f-a67919267565", "shortName": "kubernetes" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/kubernetes/kubernetes/issues/83253" }, { "name": "CVE-2019-11253: denial of service vulnerability from malicious YAML or JSON payloads", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://groups.google.com/forum/#%21topic/kubernetes-security-announce/jk8polzSUxs" }, { "name": "RHSA-2019:3239", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:3239" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://security.netapp.com/advisory/ntap-20191031-0006/" }, { "name": "RHSA-2019:3811", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:3811" }, { "name": "RHSA-2019:3905", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:3905" } ], "source": { "defect": [ "https://github.com/kubernetes/kubernetes/issues/83253" ], "discovery": "USER" }, "title": "Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack", "workarounds": [ { "lang": "en", "value": "Exposure to requests from unauthenticated users can be mitigated by removing all write permissions from unauthenticated users, following instructions at https://github.com/kubernetes/kubernetes/issues/83253" } ], "x_generator": { "engine": "Vulnogram 0.0.7" }, "x_legacyV4Record": { "CVE_data_meta": { "AKA": "", "ASSIGNER": "security@kubernetes.io", "DATE_PUBLIC": "2019-09-27", "ID": "CVE-2019-11253", "STATE": "PUBLIC", "TITLE": "Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Kubernetes", "version": { "version_data": [ { "platform": "", "version_affected": "", "version_name": "", "version_value": "prior to 1.13.12" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "prior to 1.14.8" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "prior to 1.15.5" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "prior to 1.16.2" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.1" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.2" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.3" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.4" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.5" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.6" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.7" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.8" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.9" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.10" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.11" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.12" } ] } } ] }, "vendor_name": "Kubernetes" } ] } }, "configuration": [], "credit": [ { "lang": "eng", "value": "Rory McCune" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility." } ] }, "exploit": [], "generator": { "engine": "Vulnogram 0.0.7" }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-20: Improper Input Validation" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/kubernetes/kubernetes/issues/83253", "refsource": "CONFIRM", "url": "https://github.com/kubernetes/kubernetes/issues/83253" }, { "name": "CVE-2019-11253: denial of service vulnerability from malicious YAML or JSON payloads", "refsource": "MLIST", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/jk8polzSUxs" }, { "name": "RHSA-2019:3239", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3239" }, { "name": "https://security.netapp.com/advisory/ntap-20191031-0006/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20191031-0006/" }, { "name": "RHSA-2019:3811", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3811" }, { "name": "RHSA-2019:3905", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3905" } ] }, "solution": [], "source": { "advisory": "", "defect": [ "https://github.com/kubernetes/kubernetes/issues/83253" ], "discovery": "USER" }, "work_around": [ { "lang": "en", "value": "Exposure to requests from unauthenticated users can be mitigated by removing all write permissions from unauthenticated users, following instructions at https://github.com/kubernetes/kubernetes/issues/83253" } ] } } }, "cveMetadata": { "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565", "assignerShortName": "kubernetes", "cveId": "CVE-2019-11253", "datePublished": "2019-10-17T15:40:10.154574Z", "dateReserved": "2019-04-17T00:00:00", "dateUpdated": "2024-09-16T23:21:47.959Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2019-11253\",\"sourceIdentifier\":\"jordan@liggitt.net\",\"published\":\"2019-10-17T16:15:10.443\",\"lastModified\":\"2024-11-21T04:20:48.703\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.\"},{\"lang\":\"es\",\"value\":\"La comprobaci\u00f3n de entrada inapropiada en el servidor API de Kubernetes en las versiones v1.0 hasta 1.12 y versiones anteriores a v1.13.12, v1.14.8, v1.15.5 y v1.16.2, permite a los usuarios autorizados enviar cargas maliciosas de YAML o JSON, causando que el servidor API consuma demasiada CPU o memoria, fallando potencialmente y dejando de estar disponible. En versiones anteriores a v1.14.0, la pol\u00edtica predeterminada de RBAC autorizaba a los usuarios an\u00f3nimos para enviar peticiones que pudieran desencadenar esta vulnerabilidad. Los cl\u00fasteres actualizados desde una versi\u00f3n anterior a v1.14.0 mantienen la pol\u00edtica m\u00e1s permisiva por defecto para la compatibilidad con versiones anteriores.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"jordan@liggitt.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"jordan@liggitt.net\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-776\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.1.0\",\"versionEndIncluding\":\"1.12.10\",\"matchCriteriaId\":\"F0820894-56B7-4CB8-AE5C-29639FA59718\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.13.0\",\"versionEndExcluding\":\"1.13.2\",\"matchCriteriaId\":\"9FF055F3-E11D-41DB-9ED7-434D9ED905B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.14.0\",\"versionEndExcluding\":\"1.14.8\",\"matchCriteriaId\":\"ADA3952E-8133-4E6A-A365-4FD74ABA962C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.15.0\",\"versionEndExcluding\":\"1.15.5\",\"matchCriteriaId\":\"F9F7837F-DA69-453E-8B24-1EDF0A5CAB4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.16.0\",\"versionEndExcluding\":\"1.16.2\",\"matchCriteriaId\":\"E1BDF819-871C-4E34-978F-BAFF8D895B84\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openshift_container_platform:3.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"309CB6F8-F178-454C-BE97-787F78647C28\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DBCD38F-BBE8-488C-A8C3-5782F191D915\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F87326E-0B56-4356-A889-73D026DB1D4B\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3239\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3811\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3905\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/kubernetes/kubernetes/issues/83253\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://groups.google.com/forum/#%21topic/kubernetes-security-announce/jk8polzSUxs\",\"source\":\"jordan@liggitt.net\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20191031-0006/\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3239\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3811\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3905\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/kubernetes/kubernetes/issues/83253\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://groups.google.com/forum/#%21topic/kubernetes-security-announce/jk8polzSUxs\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20191031-0006/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
rhsa-2019_3132
Vulnerability from csaf_redhat
Published
2019-10-16 15:37
Modified
2024-11-22 13:52
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.1.20 openshift security update
Notes
Topic
An update for openshift is now available for Red Hat OpenShift Container Platform 4.1.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the openshift RPM package for Red Hat
OpenShift Container Platform 4.1.20.
Security Fix(es):
* kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service (CVE-2019-11253)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openshift is now available for Red Hat OpenShift Container Platform 4.1.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the openshift RPM package for Red Hat\nOpenShift Container Platform 4.1.20.\n\nSecurity Fix(es):\n\n* kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service (CVE-2019-11253)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3132", "url": "https://access.redhat.com/errata/RHSA-2019:3132" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3132.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.1.20 openshift security update", "tracking": { "current_release_date": "2024-11-22T13:52:24+00:00", "generator": { "date": "2024-11-22T13:52:24+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:3132", "initial_release_date": "2019-10-16T15:37:03+00:00", "revision_history": [ { "date": "2019-10-16T15:37:03+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-10-16T15:37:03+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:52:24+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.1", "product": { "name": "Red Hat OpenShift Container Platform 4.1", "product_id": "8Base-RHOSE-4.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.1::el8" } } }, { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.1", "product": { "name": "Red Hat OpenShift Container Platform 4.1", "product_id": "7Server-RH7-RHOSE-4.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.1::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "openshift-0:4.1.20-201910101746.git.0.a80aad5.el8.src", "product": { "name": "openshift-0:4.1.20-201910101746.git.0.a80aad5.el8.src", "product_id": "openshift-0:4.1.20-201910101746.git.0.a80aad5.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift@4.1.20-201910101746.git.0.a80aad5.el8?arch=src" } } }, { "category": "product_version", "name": "openshift-0:4.1.20-201910101746.git.0.a80aad5.el7.src", "product": { "name": "openshift-0:4.1.20-201910101746.git.0.a80aad5.el7.src", "product_id": "openshift-0:4.1.20-201910101746.git.0.a80aad5.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift@4.1.20-201910101746.git.0.a80aad5.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "product": { "name": "openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "product_id": "openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients@4.1.20-201910101746.git.0.a80aad5.el8?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "product": { "name": "openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "product_id": "openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients-redistributable@4.1.20-201910101746.git.0.a80aad5.el8?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "product": { "name": "openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "product_id": "openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.1.20-201910101746.git.0.a80aad5.el8?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "product": { "name": "openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "product_id": "openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients@4.1.20-201910101746.git.0.a80aad5.el7?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "product": { "name": "openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "product_id": "openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients-redistributable@4.1.20-201910101746.git.0.a80aad5.el7?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "product": { "name": "openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "product_id": "openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.1.20-201910101746.git.0.a80aad5.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-0:4.1.20-201910101746.git.0.a80aad5.el7.src as a component of Red Hat OpenShift Container Platform 4.1", "product_id": "7Server-RH7-RHOSE-4.1:openshift-0:4.1.20-201910101746.git.0.a80aad5.el7.src" }, "product_reference": "openshift-0:4.1.20-201910101746.git.0.a80aad5.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-4.1" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.1", "product_id": "7Server-RH7-RHOSE-4.1:openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64" }, "product_reference": "openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.1" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.1", "product_id": "7Server-RH7-RHOSE-4.1:openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64" }, "product_reference": "openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.1" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.1", "product_id": "7Server-RH7-RHOSE-4.1:openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64" }, "product_reference": "openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.1" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-0:4.1.20-201910101746.git.0.a80aad5.el8.src as a component of Red Hat OpenShift Container Platform 4.1", "product_id": "8Base-RHOSE-4.1:openshift-0:4.1.20-201910101746.git.0.a80aad5.el8.src" }, "product_reference": "openshift-0:4.1.20-201910101746.git.0.a80aad5.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.1" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.1", "product_id": "8Base-RHOSE-4.1:openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64" }, "product_reference": "openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.1" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.1", "product_id": "8Base-RHOSE-4.1:openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64" }, "product_reference": "openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.1" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.1", "product_id": "8Base-RHOSE-4.1:openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64" }, "product_reference": "openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.1" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.1:openshift-0:4.1.20-201910101746.git.0.a80aad5.el7.src", "7Server-RH7-RHOSE-4.1:openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "7Server-RH7-RHOSE-4.1:openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "7Server-RH7-RHOSE-4.1:openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "8Base-RHOSE-4.1:openshift-0:4.1.20-201910101746.git.0.a80aad5.el8.src", "8Base-RHOSE-4.1:openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "8Base-RHOSE-4.1:openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "8Base-RHOSE-4.1:openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-10-16T15:37:03+00:00", "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.20, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html", "product_ids": [ "7Server-RH7-RHOSE-4.1:openshift-0:4.1.20-201910101746.git.0.a80aad5.el7.src", "7Server-RH7-RHOSE-4.1:openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "7Server-RH7-RHOSE-4.1:openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "7Server-RH7-RHOSE-4.1:openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "8Base-RHOSE-4.1:openshift-0:4.1.20-201910101746.git.0.a80aad5.el8.src", "8Base-RHOSE-4.1:openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "8Base-RHOSE-4.1:openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "8Base-RHOSE-4.1:openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3132" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-4.1:openshift-0:4.1.20-201910101746.git.0.a80aad5.el7.src", "7Server-RH7-RHOSE-4.1:openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "7Server-RH7-RHOSE-4.1:openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "7Server-RH7-RHOSE-4.1:openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el7.x86_64", "8Base-RHOSE-4.1:openshift-0:4.1.20-201910101746.git.0.a80aad5.el8.src", "8Base-RHOSE-4.1:openshift-clients-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "8Base-RHOSE-4.1:openshift-clients-redistributable-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64", "8Base-RHOSE-4.1:openshift-hyperkube-0:4.1.20-201910101746.git.0.a80aad5.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" } ] }
rhsa-2019_3811
Vulnerability from csaf_redhat
Published
2019-11-07 16:55
Modified
2024-11-22 13:52
Summary
Red Hat Security Advisory: OpenShift Container Platform 3.9 atomic-openshift security update
Notes
Topic
An update for atomic-openshift is now available for Red Hat OpenShift
Container Platform 3.9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the atomic-openshift RPM package for Red Hat OpenShift Container Platform 3.9.102.
Security Fix(es):
* kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service (CVE-2019-11253)
* atomic-openshift: OpenShift builds don't verify SSH Host Keys for the Git repository (CVE-2019-10150)
* kubernetes: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal (CVE-2019-11249)
* kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks (CVE-2019-11251)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for atomic-openshift is now available for Red Hat OpenShift\nContainer Platform 3.9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the atomic-openshift RPM package for Red Hat OpenShift Container Platform 3.9.102.\n\nSecurity Fix(es):\n\n* kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service (CVE-2019-11253)\n\n* atomic-openshift: OpenShift builds don\u0027t verify SSH Host Keys for the Git repository (CVE-2019-10150)\n\n* kubernetes: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal (CVE-2019-11249)\n\n* kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks (CVE-2019-11251)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3811", "url": "https://access.redhat.com/errata/RHSA-2019:3811" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1713433", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713433" }, { "category": "external", "summary": "1737651", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1737651" }, { "category": "external", "summary": "1753495", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1753495" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3811.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 3.9 atomic-openshift security update", "tracking": { "current_release_date": "2024-11-22T13:52:54+00:00", "generator": { "date": "2024-11-22T13:52:54+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:3811", "initial_release_date": "2019-11-07T16:55:40+00:00", "revision_history": [ { "date": "2019-11-07T16:55:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-11-07T16:55:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:52:54+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 3.9", "product": { "name": "Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3.9::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product": { "name": "atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_id": "atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.9.102-1.git.0.6411f52.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product": { "name": "atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_id": "atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients@3.9.102-1.git.0.6411f52.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product": { "name": "atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_id": "atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients-redistributable@3.9.102-1.git.0.6411f52.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product": { "name": "atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_id": "atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-cluster-capacity@3.9.102-1.git.0.6411f52.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product": { "name": "atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_id": "atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-federation-services@3.9.102-1.git.0.6411f52.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product": { "name": "atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_id": "atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-master@3.9.102-1.git.0.6411f52.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product": { "name": "atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_id": "atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-node@3.9.102-1.git.0.6411f52.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product": { "name": "atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_id": "atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-pod@3.9.102-1.git.0.6411f52.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product": { "name": "atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_id": "atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.9.102-1.git.0.6411f52.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product": { "name": "atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_id": "atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-service-catalog@3.9.102-1.git.0.6411f52.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product": { "name": "atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_id": "atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-template-service-broker@3.9.102-1.git.0.6411f52.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product": { "name": "atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_id": "atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-tests@3.9.102-1.git.0.6411f52.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "product": { "name": "atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "product_id": "atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.9.102-1.git.0.6411f52.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "product": { "name": "atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "product_id": "atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-docker-excluder@3.9.102-1.git.0.6411f52.el7?arch=noarch" } } }, { "category": "product_version", "name": "atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "product": { "name": "atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "product_id": "atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-excluder@3.9.102-1.git.0.6411f52.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src" }, "product_reference": "atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64" }, "product_reference": "atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64" }, "product_reference": "atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64" }, "product_reference": "atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64" }, "product_reference": "atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch" }, "product_reference": "atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch" }, "product_reference": "atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64" }, "product_reference": "atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64" }, "product_reference": "atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64" }, "product_reference": "atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64" }, "product_reference": "atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64" }, "product_reference": "atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64" }, "product_reference": "atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64" }, "product_reference": "atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.9", "product_id": "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" }, "product_reference": "atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.9" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "@l14n_uk" ] } ], "cve": "CVE-2019-10150", "cwe": { "id": "CWE-287", "name": "Improper Authentication" }, "discovery_date": "2019-05-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1713433" } ], "notes": [ { "category": "description", "text": "It was found that OpenShift Container Platform does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.", "title": "Vulnerability description" }, { "category": "summary", "text": "atomic-openshift: OpenShift builds don\u0027t verify SSH Host Keys for the git repository", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Container Platform allows for various types of \"source clone secrets\" to be defined in order to permit building from non-public git repositories. When using ssh key authentication, the server host key checking function is disabled.\n\nAn attacker with the ability to redirect the network traffic and perform a \"man in the middle\" attack will be able to redirect the build job to use arbitrary content of their choosing.\n\nNote that the same flaw (non-verification of remote server) is present when using HTTP, or when using HTTPS with TLS verification manually disabled.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10150" }, { "category": "external", "summary": "RHBZ#1713433", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713433" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10150", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10150" }, { "category": "external", "summary": "https://docs.openshift.com/container-platform/3.11/dev_guide/builds/build_inputs.html#source-secrets-ssh-key-authentication", "url": "https://docs.openshift.com/container-platform/3.11/dev_guide/builds/build_inputs.html#source-secrets-ssh-key-authentication" } ], "release_date": "2019-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-07T16:55:40+00:00", "details": "For OpenShift Container Platform 3.9 see the following documentation, which\nwill be updated shortly for release 3.9.102, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/3.9/release_notes/ocp_3_9_release_notes.html", "product_ids": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3811" }, { "category": "workaround", "details": "Use only methods (such as HTTPS with TLS verification) that enable the identity of the remote repository to be validated.", "product_ids": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "atomic-openshift: OpenShift builds don\u0027t verify SSH Host Keys for the git repository" }, { "cve": "CVE-2019-11249", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2019-08-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1737651" } ], "notes": [ { "category": "description", "text": "The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user\u2019s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user\u2019s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11249" }, { "category": "external", "summary": "RHBZ#1737651", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1737651" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11249", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11249" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11249", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11249" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/kubernetes-security-discuss/Vf31dXp0EJc", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-discuss/Vf31dXp0EJc" } ], "release_date": "2019-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-07T16:55:40+00:00", "details": "For OpenShift Container Platform 3.9 see the following documentation, which\nwill be updated shortly for release 3.9.102, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/3.9/release_notes/ocp_3_9_release_notes.html", "product_ids": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3811" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal" }, { "cve": "CVE-2019-11251", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)" }, "discovery_date": "2019-09-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1753495" } ], "notes": [ { "category": "description", "text": "The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue did not affect the version of Kubernetes(embedded in heketi) shipped with Red Hat Gluster Storage 3 as it does not include the symlink support for kubectl cp.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11251" }, { "category": "external", "summary": "RHBZ#1753495", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1753495" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11251", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11251" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11251", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11251" }, { "category": "external", "summary": "https://groups.google.com/forum/#!msg/kubernetes-announce/YYtEFdFimZ4/nZnOezZuBgAJ", "url": "https://groups.google.com/forum/#!msg/kubernetes-announce/YYtEFdFimZ4/nZnOezZuBgAJ" } ], "release_date": "2019-09-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-07T16:55:40+00:00", "details": "For OpenShift Container Platform 3.9 see the following documentation, which\nwill be updated shortly for release 3.9.102, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/3.9/release_notes/ocp_3_9_release_notes.html", "product_ids": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3811" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks" }, { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-07T16:55:40+00:00", "details": "For OpenShift Container Platform 3.9 see the following documentation, which\nwill be updated shortly for release 3.9.102, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/3.9/release_notes/ocp_3_9_release_notes.html", "product_ids": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3811" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.src", "7Server-RH7-RHOSE-3.9:atomic-openshift-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-clients-redistributable-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-cluster-capacity-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-docker-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-excluder-0:3.9.102-1.git.0.6411f52.el7.noarch", "7Server-RH7-RHOSE-3.9:atomic-openshift-federation-services-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-master-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-node-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-pod-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-sdn-ovs-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-service-catalog-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-template-service-broker-0:3.9.102-1.git.0.6411f52.el7.x86_64", "7Server-RH7-RHOSE-3.9:atomic-openshift-tests-0:3.9.102-1.git.0.6411f52.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" } ] }
rhsa-2020_2799
Vulnerability from csaf_redhat
Published
2020-07-01 18:46
Modified
2024-11-22 13:53
Summary
Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-cni security update
Notes
Topic
An update for servicemesh-cni is now available for OpenShift Service Mesh 1.1.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
Security Fix(es):
* kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service (CVE-2019-11253)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for servicemesh-cni is now available for OpenShift Service Mesh 1.1.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.\n\nSecurity Fix(es):\n\n* kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service (CVE-2019-11253)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2799", "url": "https://access.redhat.com/errata/RHSA-2020:2799" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2799.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-cni security update", "tracking": { "current_release_date": "2024-11-22T13:53:01+00:00", "generator": { "date": "2024-11-22T13:53:01+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:2799", "initial_release_date": "2020-07-01T18:46:27+00:00", "revision_history": [ { "date": "2020-07-01T18:46:27+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-01T18:46:27+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:53:01+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift Service Mesh 1.1", "product": { "name": "OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:1.1::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Service Mesh" }, { "branches": [ { "category": "product_version", "name": "servicemesh-cni-0:1.1.4-2.el8.x86_64", "product": { "name": "servicemesh-cni-0:1.1.4-2.el8.x86_64", "product_id": "servicemesh-cni-0:1.1.4-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-cni@1.1.4-2.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "servicemesh-cni-0:1.1.4-2.el8.src", "product": { "name": "servicemesh-cni-0:1.1.4-2.el8.src", "product_id": "servicemesh-cni-0:1.1.4-2.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-cni@1.1.4-2.el8?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "servicemesh-cni-0:1.1.4-2.el8.src as a component of OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1:servicemesh-cni-0:1.1.4-2.el8.src" }, "product_reference": "servicemesh-cni-0:1.1.4-2.el8.src", "relates_to_product_reference": "8Base-OSSM-1.1" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-cni-0:1.1.4-2.el8.x86_64 as a component of OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1:servicemesh-cni-0:1.1.4-2.el8.x86_64" }, "product_reference": "servicemesh-cni-0:1.1.4-2.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.1" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-cni-0:1.1.4-2.el8.src", "8Base-OSSM-1.1:servicemesh-cni-0:1.1.4-2.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-01T18:46:27+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-cni-0:1.1.4-2.el8.src", "8Base-OSSM-1.1:servicemesh-cni-0:1.1.4-2.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2799" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "8Base-OSSM-1.1:servicemesh-cni-0:1.1.4-2.el8.src", "8Base-OSSM-1.1:servicemesh-cni-0:1.1.4-2.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" } ] }
rhsa-2019_3905
Vulnerability from csaf_redhat
Published
2019-11-18 16:23
Modified
2024-11-22 13:52
Summary
Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update
Notes
Topic
An update for atomic-openshift is now available for Red Hat OpenShift
Container Platform 3.11.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the atomic-openshift RPM package for Red Hat OpenShift Container Platform 3.11.154.
Security Fix(es):
* kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service (CVE-2019-11253)
* kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks (CVE-2019-11251)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for atomic-openshift is now available for Red Hat OpenShift\nContainer Platform 3.11.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the atomic-openshift RPM package for Red Hat OpenShift Container Platform 3.11.154.\n\nSecurity Fix(es):\n\n* kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service (CVE-2019-11253)\n\n* kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks (CVE-2019-11251)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3905", "url": "https://access.redhat.com/errata/RHSA-2019:3905" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1753495", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1753495" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3905.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update", "tracking": { "current_release_date": "2024-11-22T13:52:59+00:00", "generator": { "date": "2024-11-22T13:52:59+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:3905", "initial_release_date": "2019-11-18T16:23:08+00:00", "revision_history": [ { "date": "2019-11-18T16:23:08+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-11-18T16:23:08+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:52:59+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 3.11", "product": { "name": "Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3.11::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product": { "name": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_id": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.11.154-1.git.0.7a097ad.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product": { "name": "atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_id": "atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients@3.11.154-1.git.0.7a097ad.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product": { "name": "atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_id": "atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hyperkube@3.11.154-1.git.0.7a097ad.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product": { "name": "atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_id": "atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hypershift@3.11.154-1.git.0.7a097ad.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product": { "name": "atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_id": "atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-master@3.11.154-1.git.0.7a097ad.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product": { "name": "atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_id": "atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-node@3.11.154-1.git.0.7a097ad.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product": { "name": "atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_id": "atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-pod@3.11.154-1.git.0.7a097ad.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product": { "name": "atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_id": "atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.11.154-1.git.0.7a097ad.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product": { "name": "atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_id": "atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-template-service-broker@3.11.154-1.git.0.7a097ad.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product": { "name": "atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_id": "atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-tests@3.11.154-1.git.0.7a097ad.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product": { "name": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_id": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.11.154-1.git.0.7a097ad.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product": { "name": "atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_id": "atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients@3.11.154-1.git.0.7a097ad.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-clients-redistributable-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product": { "name": "atomic-openshift-clients-redistributable-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_id": "atomic-openshift-clients-redistributable-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients-redistributable@3.11.154-1.git.0.7a097ad.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product": { "name": "atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_id": "atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hyperkube@3.11.154-1.git.0.7a097ad.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product": { "name": "atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_id": "atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hypershift@3.11.154-1.git.0.7a097ad.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product": { "name": "atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_id": "atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-master@3.11.154-1.git.0.7a097ad.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product": { "name": "atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_id": "atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-node@3.11.154-1.git.0.7a097ad.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product": { "name": "atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_id": "atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-pod@3.11.154-1.git.0.7a097ad.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product": { "name": "atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_id": "atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.11.154-1.git.0.7a097ad.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product": { "name": "atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_id": "atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-template-service-broker@3.11.154-1.git.0.7a097ad.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product": { "name": "atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_id": "atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-tests@3.11.154-1.git.0.7a097ad.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.src", "product": { "name": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.src", "product_id": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.11.154-1.git.0.7a097ad.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-docker-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "product": { "name": "atomic-openshift-docker-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "product_id": "atomic-openshift-docker-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-docker-excluder@3.11.154-1.git.0.7a097ad.el7?arch=noarch" } } }, { "category": "product_version", "name": "atomic-openshift-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "product": { "name": "atomic-openshift-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "product_id": "atomic-openshift-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-excluder@3.11.154-1.git.0.7a097ad.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le" }, "product_reference": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.src as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.src" }, "product_reference": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.x86_64" }, "product_reference": "atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.ppc64le" }, "product_reference": "atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.x86_64" }, "product_reference": "atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-redistributable-0:3.11.154-1.git.0.7a097ad.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.154-1.git.0.7a097ad.el7.x86_64" }, "product_reference": "atomic-openshift-clients-redistributable-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-docker-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch" }, "product_reference": "atomic-openshift-docker-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch" }, "product_reference": "atomic-openshift-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.ppc64le" }, "product_reference": "atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.x86_64" }, "product_reference": "atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le" }, "product_reference": "atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.x86_64" }, "product_reference": "atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.ppc64le" }, "product_reference": "atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.x86_64" }, "product_reference": "atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.ppc64le" }, "product_reference": "atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.x86_64" }, "product_reference": "atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.ppc64le" }, "product_reference": "atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.x86_64" }, "product_reference": "atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.ppc64le" }, "product_reference": "atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.x86_64" }, "product_reference": "atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.ppc64le" }, "product_reference": "atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.x86_64" }, "product_reference": "atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.ppc64le" }, "product_reference": "atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.x86_64" }, "product_reference": "atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11251", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)" }, "discovery_date": "2019-09-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1753495" } ], "notes": [ { "category": "description", "text": "The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue did not affect the version of Kubernetes(embedded in heketi) shipped with Red Hat Gluster Storage 3 as it does not include the symlink support for kubectl cp.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11251" }, { "category": "external", "summary": "RHBZ#1753495", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1753495" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11251", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11251" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11251", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11251" }, { "category": "external", "summary": "https://groups.google.com/forum/#!msg/kubernetes-announce/YYtEFdFimZ4/nZnOezZuBgAJ", "url": "https://groups.google.com/forum/#!msg/kubernetes-announce/YYtEFdFimZ4/nZnOezZuBgAJ" } ], "release_date": "2019-09-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-18T16:23:08+00:00", "details": "For OpenShift Container Platform 3.11, see the following documentation, which\nwill be updated shortly for release 3.11.154, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html", "product_ids": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3905" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks" }, { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-18T16:23:08+00:00", "details": "For OpenShift Container Platform 3.11, see the following documentation, which\nwill be updated shortly for release 3.11.154, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html", "product_ids": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3905" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.154-1.git.0.7a097ad.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.154-1.git.0.7a097ad.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.154-1.git.0.7a097ad.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" } ] }
rhsa-2020_2870
Vulnerability from csaf_redhat
Published
2020-07-07 21:17
Modified
2024-11-22 13:52
Summary
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-cni security update
Notes
Topic
An update for servicemesh-cni is now available for OpenShift Service Mesh 1.0.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
Security Fix(es):
* kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service (CVE-2019-11253)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for servicemesh-cni is now available for OpenShift Service Mesh 1.0.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.\n\nSecurity Fix(es):\n\n* kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service (CVE-2019-11253)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2870", "url": "https://access.redhat.com/errata/RHSA-2020:2870" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2870.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-cni security update", "tracking": { "current_release_date": "2024-11-22T13:52:25+00:00", "generator": { "date": "2024-11-22T13:52:25+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:2870", "initial_release_date": "2020-07-07T21:17:58+00:00", "revision_history": [ { "date": "2020-07-07T21:17:58+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-07T21:17:58+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:52:25+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift Service Mesh 1.0", "product": { "name": "OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:1.0::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Service Mesh" }, { "branches": [ { "category": "product_version", "name": "servicemesh-cni-0:1.0.11-1.el8.x86_64", "product": { "name": "servicemesh-cni-0:1.0.11-1.el8.x86_64", "product_id": "servicemesh-cni-0:1.0.11-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-cni@1.0.11-1.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "servicemesh-cni-0:1.0.11-1.el8.src", "product": { "name": "servicemesh-cni-0:1.0.11-1.el8.src", "product_id": "servicemesh-cni-0:1.0.11-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-cni@1.0.11-1.el8?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "servicemesh-cni-0:1.0.11-1.el8.src as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-cni-0:1.0.11-1.el8.src" }, "product_reference": "servicemesh-cni-0:1.0.11-1.el8.src", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-cni-0:1.0.11-1.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-cni-0:1.0.11-1.el8.x86_64" }, "product_reference": "servicemesh-cni-0:1.0.11-1.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-cni-0:1.0.11-1.el8.src", "8Base-OSSM-1.0:servicemesh-cni-0:1.0.11-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-07T21:17:58+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-cni-0:1.0.11-1.el8.src", "8Base-OSSM-1.0:servicemesh-cni-0:1.0.11-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2870" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "8Base-OSSM-1.0:servicemesh-cni-0:1.0.11-1.el8.src", "8Base-OSSM-1.0:servicemesh-cni-0:1.0.11-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" } ] }
rhsa-2019_3239
Vulnerability from csaf_redhat
Published
2019-10-29 16:22
Modified
2024-11-22 13:52
Summary
Red Hat Security Advisory: OpenShift Container Platform 3.10 atomic-openshift security update
Notes
Topic
An update for atomic-openshift is now available for Red Hat OpenShift Container Platform 3.10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service (CVE-2019-11253)
* kubernetes: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal (CVE-2019-11249)
* kube-apiserver: DoS with crafted patch of type json-patch (CVE-2019-1002100)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for atomic-openshift is now available for Red Hat OpenShift Container Platform 3.10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service (CVE-2019-11253)\n\n* kubernetes: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal (CVE-2019-11249)\n\n* kube-apiserver: DoS with crafted patch of type json-patch (CVE-2019-1002100)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3239", "url": "https://access.redhat.com/errata/RHSA-2019:3239" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1683190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683190" }, { "category": "external", "summary": "1737651", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1737651" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3239.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 3.10 atomic-openshift security update", "tracking": { "current_release_date": "2024-11-22T13:52:30+00:00", "generator": { "date": "2024-11-22T13:52:30+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:3239", "initial_release_date": "2019-10-29T16:22:25+00:00", "revision_history": [ { "date": "2019-10-29T16:22:25+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-10-29T16:22:25+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:52:30+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 3.10", "product": { "name": "Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3.10::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product": { "name": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_id": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.10.181-1.git.0.3ab4b3d.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product": { "name": "atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_id": "atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients@3.10.181-1.git.0.3ab4b3d.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product": { "name": "atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_id": "atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hyperkube@3.10.181-1.git.0.3ab4b3d.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product": { "name": "atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_id": "atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hypershift@3.10.181-1.git.0.3ab4b3d.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product": { "name": "atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_id": "atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-master@3.10.181-1.git.0.3ab4b3d.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product": { "name": "atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_id": "atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-node@3.10.181-1.git.0.3ab4b3d.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product": { "name": "atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_id": "atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-pod@3.10.181-1.git.0.3ab4b3d.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product": { "name": "atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_id": "atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.10.181-1.git.0.3ab4b3d.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product": { "name": "atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_id": "atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-template-service-broker@3.10.181-1.git.0.3ab4b3d.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product": { "name": "atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_id": "atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-tests@3.10.181-1.git.0.3ab4b3d.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product": { "name": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_id": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.10.181-1.git.0.3ab4b3d.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product": { "name": "atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_id": "atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients@3.10.181-1.git.0.3ab4b3d.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product": { "name": "atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_id": "atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients-redistributable@3.10.181-1.git.0.3ab4b3d.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product": { "name": "atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_id": "atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hyperkube@3.10.181-1.git.0.3ab4b3d.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product": { "name": "atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_id": "atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hypershift@3.10.181-1.git.0.3ab4b3d.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product": { "name": "atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_id": "atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-master@3.10.181-1.git.0.3ab4b3d.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product": { "name": "atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_id": "atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-node@3.10.181-1.git.0.3ab4b3d.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product": { "name": "atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_id": "atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-pod@3.10.181-1.git.0.3ab4b3d.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product": { "name": "atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_id": "atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.10.181-1.git.0.3ab4b3d.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product": { "name": "atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_id": "atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-template-service-broker@3.10.181-1.git.0.3ab4b3d.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product": { "name": "atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_id": "atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-tests@3.10.181-1.git.0.3ab4b3d.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "product": { "name": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "product_id": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.10.181-1.git.0.3ab4b3d.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "product": { "name": "atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "product_id": "atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-docker-excluder@3.10.181-1.git.0.3ab4b3d.el7?arch=noarch" } } }, { "category": "product_version", "name": "atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "product": { "name": "atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "product_id": "atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-excluder@3.10.181-1.git.0.3ab4b3d.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le" }, "product_reference": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src" }, "product_reference": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" }, "product_reference": "atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le" }, "product_reference": "atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" }, "product_reference": "atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" }, "product_reference": "atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch" }, "product_reference": "atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch" }, "product_reference": "atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le" }, "product_reference": "atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" }, "product_reference": "atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le" }, "product_reference": "atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" }, "product_reference": "atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le" }, "product_reference": "atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" }, "product_reference": "atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le" }, "product_reference": "atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" }, "product_reference": "atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le" }, "product_reference": "atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" }, "product_reference": "atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le" }, "product_reference": "atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" }, "product_reference": "atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le" }, "product_reference": "atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" }, "product_reference": "atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le" }, "product_reference": "atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.10", "product_id": "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" }, "product_reference": "atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.10" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11249", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2019-08-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1737651" } ], "notes": [ { "category": "description", "text": "The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user\u2019s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user\u2019s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11249" }, { "category": "external", "summary": "RHBZ#1737651", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1737651" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11249", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11249" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11249", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11249" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/kubernetes-security-discuss/Vf31dXp0EJc", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-discuss/Vf31dXp0EJc" } ], "release_date": "2019-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-10-29T16:22:25+00:00", "details": "For OpenShift Container Platform 3.10 see the following documentation,\nwhich will be updated shortly for release 3.10.181, for important\ninstructions on how to upgrade your cluster and fully apply this\nasynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.10/release_notes/ocp_3_10_release_notes.html", "product_ids": [ "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3239" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal" }, { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-10-29T16:22:25+00:00", "details": "For OpenShift Container Platform 3.10 see the following documentation,\nwhich will be updated shortly for release 3.10.181, for important\ninstructions on how to upgrade your cluster and fully apply this\nasynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.10/release_notes/ocp_3_10_release_notes.html", "product_ids": [ "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3239" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" }, { "acknowledgments": [ { "names": [ "Carl Henrik Lunde" ] } ], "cve": "CVE-2019-1002100", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1683190" } ], "notes": [ { "category": "description", "text": "A denial of service vulnerability was found in the Kubernetes API server. A remote user, with authorization to apply patches, could exploit this via crafted JSON input, causing excessive consumption of resources and subsequent denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "kube-apiserver: DoS with crafted patch of type json-patch", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the Kubernetes API Server, shipped in OpenShift Container Platform versions 3.4 through 3.11 as part of the atomic-openshift package. Red Hat Product Security has rated this issue as having a security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1002100" }, { "category": "external", "summary": "RHBZ#1683190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683190" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1002100", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1002100" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1002100", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1002100" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/kubernetes-announce/vmUUNkYfG9g", "url": "https://groups.google.com/forum/#!topic/kubernetes-announce/vmUUNkYfG9g" } ], "release_date": "2019-02-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-10-29T16:22:25+00:00", "details": "For OpenShift Container Platform 3.10 see the following documentation,\nwhich will be updated shortly for release 3.10.181, for important\ninstructions on how to upgrade your cluster and fully apply this\nasynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.10/release_notes/ocp_3_10_release_notes.html", "product_ids": [ "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3239" }, { "category": "workaround", "details": "Remove \u2018patch\u2019 permissions from untrusted users.", "product_ids": [ "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.src", "7Server-RH7-RHOSE-3.10:atomic-openshift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-clients-redistributable-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-docker-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-excluder-0:3.10.181-1.git.0.3ab4b3d.el7.noarch", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hyperkube-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-hypershift-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-master-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-node-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-pod-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-sdn-ovs-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-template-service-broker-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.ppc64le", "7Server-RH7-RHOSE-3.10:atomic-openshift-tests-0:3.10.181-1.git.0.3ab4b3d.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kube-apiserver: DoS with crafted patch of type json-patch" } ] }
rhsa-2020_2861
Vulnerability from csaf_redhat
Published
2020-07-07 19:35
Modified
2024-11-22 15:27
Summary
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana security update
Notes
Topic
An update for servicemesh-grafana is now available for OpenShift Service Mesh 1.0.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
Security Fix(es):
* kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service (CVE-2019-11253)
* grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL (CVE-2020-13379)
* npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js (CVE-2020-7660)
* npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7662)
* grafana: XSS annotation popup vulnerability (CVE-2020-12052)
* grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)
* grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for servicemesh-grafana is now available for OpenShift Service Mesh 1.0.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.\n\nSecurity Fix(es):\n\n* kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service (CVE-2019-11253)\n\n* grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL (CVE-2020-13379)\n\n* npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js (CVE-2020-7660)\n\n* npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7662)\n\n* grafana: XSS annotation popup vulnerability (CVE-2020-12052)\n\n* grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)\n\n* grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2861", "url": "https://access.redhat.com/errata/RHSA-2020:2861" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "1843640", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843640" }, { "category": "external", "summary": "1844228", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1844228" }, { "category": "external", "summary": "1845982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845982" }, { "category": "external", "summary": "1848089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848089" }, { "category": "external", "summary": "1848108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848108" }, { "category": "external", "summary": "1848643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848643" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2861.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana security update", "tracking": { "current_release_date": "2024-11-22T15:27:04+00:00", "generator": { "date": "2024-11-22T15:27:04+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:2861", "initial_release_date": "2020-07-07T19:35:07+00:00", "revision_history": [ { "date": "2020-07-07T19:35:07+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-07T19:35:07+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:27:04+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift Service Mesh 1.0", "product": { "name": "OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:1.0::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Service Mesh" }, { "branches": [ { "category": "product_version", "name": "servicemesh-grafana-0:6.2.2-38.el8.x86_64", "product": { "name": "servicemesh-grafana-0:6.2.2-38.el8.x86_64", "product_id": "servicemesh-grafana-0:6.2.2-38.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana@6.2.2-38.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64", "product": { "name": "servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64", "product_id": "servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana-prometheus@6.2.2-38.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "servicemesh-grafana-0:6.2.2-38.el8.src", "product": { "name": "servicemesh-grafana-0:6.2.2-38.el8.src", "product_id": "servicemesh-grafana-0:6.2.2-38.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana@6.2.2-38.el8?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-0:6.2.2-38.el8.src as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src" }, "product_reference": "servicemesh-grafana-0:6.2.2-38.el8.src", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-0:6.2.2-38.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64" }, "product_reference": "servicemesh-grafana-0:6.2.2-38.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" }, "product_reference": "servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-07T19:35:07+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" }, { "cve": "CVE-2020-7660", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1844228" } ], "notes": [ { "category": "description", "text": "A flaw was found in the serialize-javascript before version 3.1.0. This flaw allows remote attackers to inject arbitrary code via the function \"deleteFunctions\" within \"index.js.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay includes serialize-javascript as a dependency of webpack which is only used at build time. The vulnerable library is not used at runtime meaning this has a low impact on Red Hat Quay.\n\nThe currently supported versions of Container Native Virtualization 2 are not affected by this flaw. However, version 2.0, which is no longer supported, is affected.\n\nIn OpenShift distributed tracing there is bundled vulnerable version of the serialize-javascript Nodejs package, however access to the vulnerable function is restricted and protected by OpenShift OAuth, hence the impact by this vulnerability is reduced to Low.\n\nIn Red Hat OpenShift Logging the openshift-logging/kibana6-rhel8 container bundles many nodejs packages as a build time dependencies, including the serialize-javascript package. \nThe vulnerable code is not used hence the impact to OpenShift Logging by this vulnerability is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7660" }, { "category": "external", "summary": "RHBZ#1844228", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1844228" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7660", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7660" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7660", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7660" } ], "release_date": "2020-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-07T19:35:07+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js" }, { "cve": "CVE-2020-7662", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-06-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1845982" } ], "notes": [ { "category": "description", "text": "websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.", "title": "Vulnerability description" }, { "category": "summary", "text": "npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable websocket-extension to authenticated users only, therefore the impact is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7662" }, { "category": "external", "summary": "RHBZ#1845982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845982" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7662", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7662" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7662", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7662" }, { "category": "external", "summary": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv", "url": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv" } ], "release_date": "2020-06-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-07T19:35:07+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser" }, { "cve": "CVE-2020-12052", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848089" } ], "notes": [ { "category": "description", "text": "A flaw was found in grafana. The software is vulnerable to an annotation popup XSS.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS annotation popup vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the version of the grafana package as shipped with Red Hat Ceph Storage (RHCS) version 2. Ceph-2 has reached End of Extended Life Cycle Support and no longer fixing moderates/lows.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-12052" }, { "category": "external", "summary": "RHBZ#1848089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848089" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-12052", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12052" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12052", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12052" } ], "release_date": "2020-04-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-07T19:35:07+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: XSS annotation popup vulnerability" }, { "cve": "CVE-2020-12245", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848643" } ], "notes": [ { "category": "description", "text": "A flaw was found in grafana. A XSS is possible in table-panel via column.title or cellLinkTooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS via column.title or cellLinkTooltip", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-12245" }, { "category": "external", "summary": "RHBZ#1848643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848643" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-12245", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12245" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12245", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12245" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-07T19:35:07+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: XSS via column.title or cellLinkTooltip" }, { "cve": "CVE-2020-13379", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "discovery_date": "2020-06-03T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1843640" } ], "notes": [ { "category": "description", "text": "An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the same issue can create a NULL pointer dereference vulnerability. This flaw allows an attacker to gain information about the network that Grafana is running on, or cause a segmentation fault, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the Grafana containers are behind OpenShift OAuth restricting access to the vulnerable path to authenticated users only. However, other pods may still access the vulnerable URL within the cluster. Therefore the impact is moderate for both (OCP and OSSM).\n\nRed Hat Ceph Storage 2 is now in Extended Life Support (ELS) Phase of the support. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Ceph Storage Life Cycle: https://access.redhat.com/support/policy/updates/ceph-storage", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-13379" }, { "category": "external", "summary": "RHBZ#1843640", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843640" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-13379", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13379" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13379", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13379" }, { "category": "external", "summary": "https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/", "url": "https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2020/06/09/2/", "url": "https://www.openwall.com/lists/oss-security/2020/06/09/2/" } ], "release_date": "2020-06-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-07T19:35:07+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" }, { "category": "workaround", "details": "This issue can be mitigated by blocking access to the URL path /avatar/*, through a method such as a reverse proxy, load balancer, application firewall etc.", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL" }, { "cve": "CVE-2020-13430", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848108" } ], "notes": [ { "category": "description", "text": "A flaw was found in grafana Tag value XSS via the OpenTSDB datasource are possible. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS via the OpenTSDB datasource", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Ceph Storage (RHCS) delivers the affected code of the grafana OpenTSDB plugin. However Red Hat Ceph Storage uses the Prometheus time-series database as a default data source not the OpenTSDB, hence the impact by this vulnerability is set to low.\n\nRed Hat Gluster Storage (RHGS) delivers the affected code of the grafana OpenTSDB plugin. However Red Hat Gluster Storage uses the Graphite as a data source not the OpenTSDB, hence the impact by this vulnerability is set to low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-13430" }, { "category": "external", "summary": "RHBZ#1848108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848108" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-13430", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13430" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13430", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13430" } ], "release_date": "2020-05-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-07T19:35:07+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: XSS via the OpenTSDB datasource" } ] }
rhsa-2020_2863
Vulnerability from csaf_redhat
Published
2020-07-07 19:35
Modified
2024-11-22 13:53
Summary
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-prometheus security update
Notes
Topic
An update for servicemesh-prometheus is now available for OpenShift Service Mesh 1.0.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
Security Fix(es):
* kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service (CVE-2019-11253)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for servicemesh-prometheus is now available for OpenShift Service Mesh 1.0.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.\n\nSecurity Fix(es):\n\n* kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service (CVE-2019-11253)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2863", "url": "https://access.redhat.com/errata/RHSA-2020:2863" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2863.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-prometheus security update", "tracking": { "current_release_date": "2024-11-22T13:53:16+00:00", "generator": { "date": "2024-11-22T13:53:16+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:2863", "initial_release_date": "2020-07-07T19:35:16+00:00", "revision_history": [ { "date": "2020-07-07T19:35:16+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-07T19:35:16+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:53:16+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift Service Mesh 1.0", "product": { "name": "OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:1.0::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Service Mesh" }, { "branches": [ { "category": "product_version", "name": "servicemesh-prometheus-0:2.7.2-36.el8.x86_64", "product": { "name": "servicemesh-prometheus-0:2.7.2-36.el8.x86_64", "product_id": "servicemesh-prometheus-0:2.7.2-36.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-prometheus@2.7.2-36.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "servicemesh-prometheus-0:2.7.2-36.el8.src", "product": { "name": "servicemesh-prometheus-0:2.7.2-36.el8.src", "product_id": "servicemesh-prometheus-0:2.7.2-36.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-prometheus@2.7.2-36.el8?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "servicemesh-prometheus-0:2.7.2-36.el8.src as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-36.el8.src" }, "product_reference": "servicemesh-prometheus-0:2.7.2-36.el8.src", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-prometheus-0:2.7.2-36.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-36.el8.x86_64" }, "product_reference": "servicemesh-prometheus-0:2.7.2-36.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-36.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-07T19:35:16+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and known issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-36.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2863" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-36.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" } ] }
rhsa-2022_2183
Vulnerability from csaf_redhat
Published
2022-05-11 11:33
Modified
2024-12-17 21:57
Summary
Red Hat Security Advisory: Release of containers for OSP 16.2.z director operator tech preview
Notes
Topic
Red Hat OpenStack Platform 16.2 (Train) director Operator containers are
available for technology preview.
Details
Release osp-director-operator images
Security Fix(es):
* golang: kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote (CVE-2019-11253)
* golang: golang-github-miekg-dns: predictable TXID can lead to response forgeries (CVE-2019-19794)
* golang: containerd: unrestricted access to abstract Unix domain socket can lead to privileges (CVE-2020-15257)
* golang: ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)
* golang: containerd: pulling and extracting crafted container image may result in Unix file permission changes (CVE-2021-32760)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat OpenStack Platform 16.2 (Train) director Operator containers are\navailable for technology preview.", "title": "Topic" }, { "category": "general", "text": "Release osp-director-operator images\n\nSecurity Fix(es):\n\n* golang: kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote (CVE-2019-11253)\n* golang: golang-github-miekg-dns: predictable TXID can lead to response forgeries (CVE-2019-19794)\n* golang: containerd: unrestricted access to abstract Unix domain socket can lead to privileges (CVE-2020-15257)\n* golang: ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)\n* golang: containerd: pulling and extracting crafted container image may result in Unix file permission changes (CVE-2021-32760)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:2183", "url": "https://access.redhat.com/errata/RHSA-2022:2183" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "1786761", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1786761" }, { "category": "external", "summary": "1899487", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1899487" }, { "category": "external", "summary": "1954368", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954368" }, { "category": "external", "summary": "1982681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982681" }, { "category": "external", "summary": "2079447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2079447" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_2183.json" } ], "title": "Red Hat Security Advisory: Release of containers for OSP 16.2.z director operator tech preview", "tracking": { "current_release_date": "2024-12-17T21:57:06+00:00", "generator": { "date": "2024-12-17T21:57:06+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHSA-2022:2183", "initial_release_date": "2022-05-11T11:33:14+00:00", "revision_history": [ { "date": "2022-05-11T11:33:14+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-05-11T11:33:14+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-17T21:57:06+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenStack Platform 16.2", "product": { "name": "Red Hat OpenStack Platform 16.2", "product_id": "8Base-RHOS-16.2", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:16.2::el8" } } } ], "category": "product_family", "name": "Red Hat OpenStack Platform" }, { "branches": [ { "category": "product_version", "name": "rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "product": { "name": "rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "product_id": "rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "product_identification_helper": { "purl": "pkg:oci/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb?arch=amd64\u0026repository_url=registry.redhat.io/rhosp-rhel8-tech-preview/osp-director-downloader\u0026tag=1.2.3-2" } } }, { "category": "product_version", "name": "rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64", "product": { "name": "rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64", "product_id": "rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64", "product_identification_helper": { "purl": "pkg:oci/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d?arch=amd64\u0026repository_url=registry.redhat.io/rhosp-rhel8-tech-preview/osp-director-operator-bundle\u0026tag=1.2.3-3" } } }, { "category": "product_version", "name": "rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64", "product": { "name": "rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64", "product_id": "rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64", "product_identification_helper": { "purl": "pkg:oci/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56?arch=amd64\u0026repository_url=registry.redhat.io/rhosp-rhel8-tech-preview/osp-director-operator\u0026tag=1.2.3-2" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64 as a component of Red Hat OpenStack Platform 16.2", "product_id": "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64" }, "product_reference": "rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "relates_to_product_reference": "8Base-RHOS-16.2" }, { "category": "default_component_of", "full_product_name": { "name": "rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64 as a component of Red Hat OpenStack Platform 16.2", "product_id": "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64" }, "product_reference": "rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64", "relates_to_product_reference": "8Base-RHOS-16.2" }, { "category": "default_component_of", "full_product_name": { "name": "rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64 as a component of Red Hat OpenStack Platform 16.2", "product_id": "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" }, "product_reference": "rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64", "relates_to_product_reference": "8Base-RHOS-16.2" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ], "known_not_affected": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-05-11T11:33:14+00:00", "details": "OSP 16.2 Release - OSP Director Operator Containers tech preview", "product_ids": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:2183" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" }, { "cve": "CVE-2019-19794", "cwe": { "id": "CWE-338", "name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)" }, "discovery_date": "2019-12-27T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1786761" } ], "notes": [ { "category": "description", "text": "The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang-github-miekg-dns: predictable TXID can lead to response forgeries", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ], "known_not_affected": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-19794" }, { "category": "external", "summary": "RHBZ#1786761", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1786761" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-19794", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19794" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-19794", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19794" } ], "release_date": "2019-12-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-05-11T11:33:14+00:00", "details": "OSP 16.2 Release - OSP Director Operator Containers tech preview", "product_ids": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:2183" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang-github-miekg-dns: predictable TXID can lead to response forgeries" }, { "cve": "CVE-2020-15257", "cwe": { "id": "CWE-269", "name": "Improper Privilege Management" }, "discovery_date": "2020-11-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1899487" } ], "notes": [ { "category": "description", "text": "A flaw was found in containerd. Access controls for the shim\u0027s API socket verified that a connecting process had an effective UID of 0, but otherwise did not restrict access to the abstract Unix domain socket. This could allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "containerd: unrestricted access to abstract Unix domain socket can lead to privileges escalation", "title": "Vulnerability summary" }, { "category": "other", "text": "* The container runtime in OpenShift Container Platform 4 is cri-o which is not affected by this flaw. It doesn\u0027t make use of abstract unix sockets like containerd, which lead to this vulnerability being possible.\n\n* Red Hat Advanced Cluster Management for Kubernetes is not affected by this flaw. While containerd is included in the multicloud-operators-subscription image as a dependency of helm, it is not used in any way that exposes the abstract unix socket that is involved in this vulnerability.\n\n* The container-tools module in Red Hat Enterprise Linux is not affected by this flaw as these packages do not use abstract unix sockets for container management.\n\n* For Red Hat OpenStack Platform, because containerd is not actually used in director-operator, the RHOSP Impact has been moved to Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ], "known_not_affected": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15257" }, { "category": "external", "summary": "RHBZ#1899487", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1899487" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15257", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15257" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15257", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15257" } ], "release_date": "2020-11-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-05-11T11:33:14+00:00", "details": "OSP 16.2 Release - OSP Director Operator Containers tech preview", "product_ids": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:2183" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "containerd: unrestricted access to abstract Unix domain socket can lead to privileges escalation" }, { "cve": "CVE-2021-29482", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-04-28T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1954368" } ], "notes": [ { "category": "description", "text": "A flaw was found in github.com/ulikunitz/xz. The function readUvarint may not terminate a loop what could lead to denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "ulikunitz/xz: Infinite loop in readUvarint allows for denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth authentication, therefore the impact is low.\nIn OCP before 4.7 the buildah, skopeo and podman packages include vulnerable version of github.com/ulikunitz/xz, but these OCP releases are already in the Maintenance Phase of the support, hence affected components are marked as wontfix. This may be fixed in the future.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ], "known_not_affected": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-29482" }, { "category": "external", "summary": "RHBZ#1954368", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954368" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-29482", "url": "https://www.cve.org/CVERecord?id=CVE-2021-29482" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-29482", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29482" } ], "release_date": "2020-08-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-05-11T11:33:14+00:00", "details": "OSP 16.2 Release - OSP Director Operator Containers tech preview", "product_ids": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:2183" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ulikunitz/xz: Infinite loop in readUvarint allows for denial of service" }, { "acknowledgments": [ { "names": [ "distros" ], "organization": "distros" } ], "cve": "CVE-2021-32760", "cwe": { "id": "CWE-281", "name": "Improper Preservation of Permissions" }, "discovery_date": "2021-07-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1982681" } ], "notes": [ { "category": "description", "text": "A flaw was found in containerd where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host\u2019s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process.", "title": "Vulnerability description" }, { "category": "summary", "text": "containerd: pulling and extracting crafted container image may result in Unix file permission changes", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ], "known_not_affected": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-32760" }, { "category": "external", "summary": "RHBZ#1982681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32760", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32760" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32760", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32760" } ], "release_date": "2021-07-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-05-11T11:33:14+00:00", "details": "OSP 16.2 Release - OSP Director Operator Containers tech preview", "product_ids": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:2183" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64", "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "containerd: pulling and extracting crafted container image may result in Unix file permission changes" } ] }
rhsa-2020_2795
Vulnerability from csaf_redhat
Published
2020-07-01 18:46
Modified
2024-11-22 15:26
Summary
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1 servicemesh-operator security update
Notes
Topic
An update for servicemesh-operator is now available for OpenShift Service Mesh 1.1.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
Security Fix(es):
* kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service (CVE-2019-11253)
* openshift-service-mesh/istio-rhel8-operator: control plane can deploy gateway image to any namespace (CVE-2020-14306)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for servicemesh-operator is now available for OpenShift Service Mesh 1.1.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.\n\nSecurity Fix(es):\n\n* kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service (CVE-2019-11253)\n\n* openshift-service-mesh/istio-rhel8-operator: control plane can deploy gateway image to any namespace (CVE-2020-14306)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2795", "url": "https://access.redhat.com/errata/RHSA-2020:2795" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "1850380", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850380" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2795.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1 servicemesh-operator security update", "tracking": { "current_release_date": "2024-11-22T15:26:43+00:00", "generator": { "date": "2024-11-22T15:26:43+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:2795", "initial_release_date": "2020-07-01T18:46:42+00:00", "revision_history": [ { "date": "2020-07-01T18:46:42+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-01T18:46:42+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:26:43+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift Service Mesh 1.1", "product": { "name": "OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:1.1::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Service Mesh" }, { "branches": [ { "category": "product_version", "name": "servicemesh-operator-0:1.1.4-3.el8.x86_64", "product": { "name": "servicemesh-operator-0:1.1.4-3.el8.x86_64", "product_id": "servicemesh-operator-0:1.1.4-3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-operator@1.1.4-3.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "servicemesh-operator-0:1.1.4-3.el8.src", "product": { "name": "servicemesh-operator-0:1.1.4-3.el8.src", "product_id": "servicemesh-operator-0:1.1.4-3.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-operator@1.1.4-3.el8?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "servicemesh-operator-0:1.1.4-3.el8.src as a component of OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.src" }, "product_reference": "servicemesh-operator-0:1.1.4-3.el8.src", "relates_to_product_reference": "8Base-OSSM-1.1" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-operator-0:1.1.4-3.el8.x86_64 as a component of OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.x86_64" }, "product_reference": "servicemesh-operator-0:1.1.4-3.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.1" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.src", "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-01T18:46:42+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.src", "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2795" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.src", "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" }, { "acknowledgments": [ { "names": [ "Daniel Grimm" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2020-14306", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "discovery_date": "2020-06-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850380" } ], "notes": [ { "category": "description", "text": "An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator. This flaw allows an attacker with a basic level of access to the cluster to deploy a custom gateway/pod to any namespace, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "openshift-service-mesh/istio-rhel8-operator: control plane can deploy gateway image to any namespace", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.src", "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-14306" }, { "category": "external", "summary": "RHBZ#1850380", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850380" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14306", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14306" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14306", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14306" } ], "release_date": "2020-06-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-01T18:46:42+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.src", "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2795" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.src", "8Base-OSSM-1.1:servicemesh-operator-0:1.1.4-3.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "openshift-service-mesh/istio-rhel8-operator: control plane can deploy gateway image to any namespace" } ] }
rhea-2019_3809
Vulnerability from csaf_redhat
Published
2019-11-07 15:16
Modified
2024-11-22 13:52
Summary
Red Hat Enhancement Advisory: Red Hat OpenShift Service Mesh 1.0.2 RPMs
Notes
Topic
Red Hat OpenShift Service Mesh 1.0.2.
Details
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
The OpenShift Service Mesh release notes provide information on the features and known issues:
https://docs.openshift.com/container-platform/4.2/service_mesh/servicemesh-release-notes.html
This advisory covers the RPM packages for the release.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat OpenShift Service Mesh 1.0.2.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.\n\nThe OpenShift Service Mesh release notes provide information on the features and known issues:\n\nhttps://docs.openshift.com/container-platform/4.2/service_mesh/servicemesh-release-notes.html\n\nThis advisory covers the RPM packages for the release.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHEA-2019:3809", "url": "https://access.redhat.com/errata/RHEA-2019:3809" }, { "category": "external", "summary": "MAISTRA-947", "url": "https://issues.redhat.com/browse/MAISTRA-947" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhea-2019_3809.json" } ], "title": "Red Hat Enhancement Advisory: Red Hat OpenShift Service Mesh 1.0.2 RPMs", "tracking": { "current_release_date": "2024-11-22T13:52:47+00:00", "generator": { "date": "2024-11-22T13:52:47+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHEA-2019:3809", "initial_release_date": "2019-11-07T15:16:59+00:00", "revision_history": [ { "date": "2019-11-07T15:16:59+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-11-07T15:17:00+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:52:47+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Service Mesh 1.0", "product": { "name": "Red Hat OpenShift Service Mesh 1.0", "product_id": "7Server-RH7-RHOSSM-1.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:1.0::el7" } } }, { "category": "product_name", "name": "OpenShift Service Mesh 1.0", "product": { "name": "OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:1.0::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Service Mesh" }, { "branches": [ { "category": "product_version", "name": "kiali-0:v1.0.7.redhat1-1.el7.x86_64", "product": { "name": "kiali-0:v1.0.7.redhat1-1.el7.x86_64", "product_id": "kiali-0:v1.0.7.redhat1-1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/kiali@v1.0.7.redhat1-1.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jaeger-0:v1.13.1.redhat5-1.el7.x86_64", "product": { "name": "jaeger-0:v1.13.1.redhat5-1.el7.x86_64", "product_id": "jaeger-0:v1.13.1.redhat5-1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jaeger@v1.13.1.redhat5-1.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jaeger-operator-0:v1.13.1.redhat8-1.el7.x86_64", "product": { "name": "jaeger-operator-0:v1.13.1.redhat8-1.el7.x86_64", "product_id": "jaeger-operator-0:v1.13.1.redhat8-1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jaeger-operator@v1.13.1.redhat8-1.el7?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-cni-0:1.0.2-3.el8.x86_64", "product": { "name": "servicemesh-cni-0:1.0.2-3.el8.x86_64", "product_id": "servicemesh-cni-0:1.0.2-3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-cni@1.0.2-3.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-prometheus-0:2.7.2-25.el8.x86_64", "product": { "name": "servicemesh-prometheus-0:2.7.2-25.el8.x86_64", "product_id": "servicemesh-prometheus-0:2.7.2-25.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-prometheus@2.7.2-25.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-0:1.0.2-3.el8.x86_64", "product": { "name": "servicemesh-0:1.0.2-3.el8.x86_64", "product_id": "servicemesh-0:1.0.2-3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh@1.0.2-3.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-citadel-0:1.0.2-3.el8.x86_64", "product": { "name": "servicemesh-citadel-0:1.0.2-3.el8.x86_64", "product_id": "servicemesh-citadel-0:1.0.2-3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-citadel@1.0.2-3.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-galley-0:1.0.2-3.el8.x86_64", "product": { "name": "servicemesh-galley-0:1.0.2-3.el8.x86_64", "product_id": "servicemesh-galley-0:1.0.2-3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-galley@1.0.2-3.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-istioctl-0:1.0.2-3.el8.x86_64", "product": { "name": "servicemesh-istioctl-0:1.0.2-3.el8.x86_64", "product_id": "servicemesh-istioctl-0:1.0.2-3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-istioctl@1.0.2-3.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-mixc-0:1.0.2-3.el8.x86_64", "product": { "name": "servicemesh-mixc-0:1.0.2-3.el8.x86_64", "product_id": "servicemesh-mixc-0:1.0.2-3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-mixc@1.0.2-3.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-mixs-0:1.0.2-3.el8.x86_64", "product": { "name": "servicemesh-mixs-0:1.0.2-3.el8.x86_64", "product_id": "servicemesh-mixs-0:1.0.2-3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-mixs@1.0.2-3.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-pilot-agent-0:1.0.2-3.el8.x86_64", "product": { "name": "servicemesh-pilot-agent-0:1.0.2-3.el8.x86_64", "product_id": "servicemesh-pilot-agent-0:1.0.2-3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-pilot-agent@1.0.2-3.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-pilot-discovery-0:1.0.2-3.el8.x86_64", "product": { "name": "servicemesh-pilot-discovery-0:1.0.2-3.el8.x86_64", "product_id": "servicemesh-pilot-discovery-0:1.0.2-3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-pilot-discovery@1.0.2-3.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-sidecar-injector-0:1.0.2-3.el8.x86_64", "product": { "name": "servicemesh-sidecar-injector-0:1.0.2-3.el8.x86_64", "product_id": "servicemesh-sidecar-injector-0:1.0.2-3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-sidecar-injector@1.0.2-3.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-grafana-0:6.2.2-24.el8.x86_64", "product": { "name": "servicemesh-grafana-0:6.2.2-24.el8.x86_64", "product_id": "servicemesh-grafana-0:6.2.2-24.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana@6.2.2-24.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-grafana-prometheus-0:6.2.2-24.el8.x86_64", "product": { "name": "servicemesh-grafana-prometheus-0:6.2.2-24.el8.x86_64", "product_id": "servicemesh-grafana-prometheus-0:6.2.2-24.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana-prometheus@6.2.2-24.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-proxy-0:1.0.2-3.el8.x86_64", "product": { "name": "servicemesh-proxy-0:1.0.2-3.el8.x86_64", "product_id": "servicemesh-proxy-0:1.0.2-3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-proxy@1.0.2-3.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-operator-0:1.0.2-7.el8.x86_64", "product": { "name": "servicemesh-operator-0:1.0.2-7.el8.x86_64", "product_id": "servicemesh-operator-0:1.0.2-7.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-operator@1.0.2-7.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "kiali-0:v1.0.7.redhat1-1.el7.src", "product": { "name": "kiali-0:v1.0.7.redhat1-1.el7.src", "product_id": "kiali-0:v1.0.7.redhat1-1.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/kiali@v1.0.7.redhat1-1.el7?arch=src" } } }, { "category": "product_version", "name": "jaeger-0:v1.13.1.redhat5-1.el7.src", "product": { "name": "jaeger-0:v1.13.1.redhat5-1.el7.src", "product_id": "jaeger-0:v1.13.1.redhat5-1.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jaeger@v1.13.1.redhat5-1.el7?arch=src" } } }, { "category": "product_version", "name": "jaeger-operator-0:v1.13.1.redhat8-1.el7.src", "product": { "name": "jaeger-operator-0:v1.13.1.redhat8-1.el7.src", "product_id": "jaeger-operator-0:v1.13.1.redhat8-1.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jaeger-operator@v1.13.1.redhat8-1.el7?arch=src" } } }, { "category": "product_version", "name": "servicemesh-cni-0:1.0.2-3.el8.src", "product": { "name": "servicemesh-cni-0:1.0.2-3.el8.src", "product_id": "servicemesh-cni-0:1.0.2-3.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-cni@1.0.2-3.el8?arch=src" } } }, { "category": "product_version", "name": "servicemesh-prometheus-0:2.7.2-25.el8.src", "product": { "name": "servicemesh-prometheus-0:2.7.2-25.el8.src", "product_id": "servicemesh-prometheus-0:2.7.2-25.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-prometheus@2.7.2-25.el8?arch=src" } } }, { "category": "product_version", "name": "servicemesh-0:1.0.2-3.el8.src", "product": { "name": "servicemesh-0:1.0.2-3.el8.src", "product_id": "servicemesh-0:1.0.2-3.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh@1.0.2-3.el8?arch=src" } } }, { "category": "product_version", "name": "servicemesh-grafana-0:6.2.2-24.el8.src", "product": { "name": "servicemesh-grafana-0:6.2.2-24.el8.src", "product_id": "servicemesh-grafana-0:6.2.2-24.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana@6.2.2-24.el8?arch=src" } } }, { "category": "product_version", "name": "servicemesh-proxy-0:1.0.2-3.el8.src", "product": { "name": "servicemesh-proxy-0:1.0.2-3.el8.src", "product_id": "servicemesh-proxy-0:1.0.2-3.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-proxy@1.0.2-3.el8?arch=src" } } }, { "category": "product_version", "name": "servicemesh-operator-0:1.0.2-7.el8.src", "product": { "name": "servicemesh-operator-0:1.0.2-7.el8.src", "product_id": "servicemesh-operator-0:1.0.2-7.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-operator@1.0.2-7.el8?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jaeger-0:v1.13.1.redhat5-1.el7.src as a component of Red Hat OpenShift Service Mesh 1.0", "product_id": "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat5-1.el7.src" }, "product_reference": "jaeger-0:v1.13.1.redhat5-1.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "jaeger-0:v1.13.1.redhat5-1.el7.x86_64 as a component of Red Hat OpenShift Service Mesh 1.0", "product_id": "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat5-1.el7.x86_64" }, "product_reference": "jaeger-0:v1.13.1.redhat5-1.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "jaeger-operator-0:v1.13.1.redhat8-1.el7.src as a component of Red Hat OpenShift Service Mesh 1.0", "product_id": "7Server-RH7-RHOSSM-1.0:jaeger-operator-0:v1.13.1.redhat8-1.el7.src" }, "product_reference": "jaeger-operator-0:v1.13.1.redhat8-1.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "jaeger-operator-0:v1.13.1.redhat8-1.el7.x86_64 as a component of Red Hat OpenShift Service Mesh 1.0", "product_id": "7Server-RH7-RHOSSM-1.0:jaeger-operator-0:v1.13.1.redhat8-1.el7.x86_64" }, "product_reference": "jaeger-operator-0:v1.13.1.redhat8-1.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "kiali-0:v1.0.7.redhat1-1.el7.src as a component of Red Hat OpenShift Service Mesh 1.0", "product_id": "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.7.redhat1-1.el7.src" }, "product_reference": "kiali-0:v1.0.7.redhat1-1.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "kiali-0:v1.0.7.redhat1-1.el7.x86_64 as a component of Red Hat OpenShift Service Mesh 1.0", "product_id": "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.7.redhat1-1.el7.x86_64" }, "product_reference": "kiali-0:v1.0.7.redhat1-1.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-0:1.0.2-3.el8.src as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-0:1.0.2-3.el8.src" }, "product_reference": "servicemesh-0:1.0.2-3.el8.src", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-0:1.0.2-3.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-0:1.0.2-3.el8.x86_64" }, "product_reference": "servicemesh-0:1.0.2-3.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-citadel-0:1.0.2-3.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-citadel-0:1.0.2-3.el8.x86_64" }, "product_reference": "servicemesh-citadel-0:1.0.2-3.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-cni-0:1.0.2-3.el8.src as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-cni-0:1.0.2-3.el8.src" }, "product_reference": "servicemesh-cni-0:1.0.2-3.el8.src", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-cni-0:1.0.2-3.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-cni-0:1.0.2-3.el8.x86_64" }, "product_reference": "servicemesh-cni-0:1.0.2-3.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-galley-0:1.0.2-3.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-galley-0:1.0.2-3.el8.x86_64" }, "product_reference": "servicemesh-galley-0:1.0.2-3.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-0:6.2.2-24.el8.src as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-24.el8.src" }, "product_reference": "servicemesh-grafana-0:6.2.2-24.el8.src", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-0:6.2.2-24.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-24.el8.x86_64" }, "product_reference": "servicemesh-grafana-0:6.2.2-24.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-prometheus-0:6.2.2-24.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-24.el8.x86_64" }, "product_reference": "servicemesh-grafana-prometheus-0:6.2.2-24.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-istioctl-0:1.0.2-3.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-istioctl-0:1.0.2-3.el8.x86_64" }, "product_reference": "servicemesh-istioctl-0:1.0.2-3.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-mixc-0:1.0.2-3.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-mixc-0:1.0.2-3.el8.x86_64" }, "product_reference": "servicemesh-mixc-0:1.0.2-3.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-mixs-0:1.0.2-3.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-mixs-0:1.0.2-3.el8.x86_64" }, "product_reference": "servicemesh-mixs-0:1.0.2-3.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-operator-0:1.0.2-7.el8.src as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-operator-0:1.0.2-7.el8.src" }, "product_reference": "servicemesh-operator-0:1.0.2-7.el8.src", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-operator-0:1.0.2-7.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-operator-0:1.0.2-7.el8.x86_64" }, "product_reference": "servicemesh-operator-0:1.0.2-7.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-pilot-agent-0:1.0.2-3.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-pilot-agent-0:1.0.2-3.el8.x86_64" }, "product_reference": "servicemesh-pilot-agent-0:1.0.2-3.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-pilot-discovery-0:1.0.2-3.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-pilot-discovery-0:1.0.2-3.el8.x86_64" }, "product_reference": "servicemesh-pilot-discovery-0:1.0.2-3.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-prometheus-0:2.7.2-25.el8.src as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-25.el8.src" }, "product_reference": "servicemesh-prometheus-0:2.7.2-25.el8.src", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-prometheus-0:2.7.2-25.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-25.el8.x86_64" }, "product_reference": "servicemesh-prometheus-0:2.7.2-25.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-proxy-0:1.0.2-3.el8.src as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-proxy-0:1.0.2-3.el8.src" }, "product_reference": "servicemesh-proxy-0:1.0.2-3.el8.src", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-proxy-0:1.0.2-3.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-proxy-0:1.0.2-3.el8.x86_64" }, "product_reference": "servicemesh-proxy-0:1.0.2-3.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-sidecar-injector-0:1.0.2-3.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-sidecar-injector-0:1.0.2-3.el8.x86_64" }, "product_reference": "servicemesh-sidecar-injector-0:1.0.2-3.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat5-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat5-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:jaeger-operator-0:v1.13.1.redhat8-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-operator-0:v1.13.1.redhat8-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.7.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.7.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-0:1.0.2-3.el8.src", "8Base-OSSM-1.0:servicemesh-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-citadel-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-cni-0:1.0.2-3.el8.src", "8Base-OSSM-1.0:servicemesh-cni-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-galley-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-24.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-24.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-24.el8.x86_64", "8Base-OSSM-1.0:servicemesh-istioctl-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-mixc-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-mixs-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-operator-0:1.0.2-7.el8.src", "8Base-OSSM-1.0:servicemesh-operator-0:1.0.2-7.el8.x86_64", "8Base-OSSM-1.0:servicemesh-pilot-agent-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-pilot-discovery-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-25.el8.src", "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-25.el8.x86_64", "8Base-OSSM-1.0:servicemesh-proxy-0:1.0.2-3.el8.src", "8Base-OSSM-1.0:servicemesh-proxy-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-sidecar-injector-0:1.0.2-3.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-07T15:16:59+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat5-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat5-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:jaeger-operator-0:v1.13.1.redhat8-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-operator-0:v1.13.1.redhat8-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.7.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.7.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-0:1.0.2-3.el8.src", "8Base-OSSM-1.0:servicemesh-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-citadel-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-cni-0:1.0.2-3.el8.src", "8Base-OSSM-1.0:servicemesh-cni-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-galley-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-24.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-24.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-24.el8.x86_64", "8Base-OSSM-1.0:servicemesh-istioctl-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-mixc-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-mixs-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-operator-0:1.0.2-7.el8.src", "8Base-OSSM-1.0:servicemesh-operator-0:1.0.2-7.el8.x86_64", "8Base-OSSM-1.0:servicemesh-pilot-agent-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-pilot-discovery-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-25.el8.src", "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-25.el8.x86_64", "8Base-OSSM-1.0:servicemesh-proxy-0:1.0.2-3.el8.src", "8Base-OSSM-1.0:servicemesh-proxy-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-sidecar-injector-0:1.0.2-3.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2019:3809" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat5-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat5-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:jaeger-operator-0:v1.13.1.redhat8-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-operator-0:v1.13.1.redhat8-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.7.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.7.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-0:1.0.2-3.el8.src", "8Base-OSSM-1.0:servicemesh-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-citadel-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-cni-0:1.0.2-3.el8.src", "8Base-OSSM-1.0:servicemesh-cni-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-galley-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-24.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-24.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-24.el8.x86_64", "8Base-OSSM-1.0:servicemesh-istioctl-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-mixc-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-mixs-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-operator-0:1.0.2-7.el8.src", "8Base-OSSM-1.0:servicemesh-operator-0:1.0.2-7.el8.x86_64", "8Base-OSSM-1.0:servicemesh-pilot-agent-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-pilot-discovery-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-25.el8.src", "8Base-OSSM-1.0:servicemesh-prometheus-0:2.7.2-25.el8.x86_64", "8Base-OSSM-1.0:servicemesh-proxy-0:1.0.2-3.el8.src", "8Base-OSSM-1.0:servicemesh-proxy-0:1.0.2-3.el8.x86_64", "8Base-OSSM-1.0:servicemesh-sidecar-injector-0:1.0.2-3.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" } ] }
rhsa-2020_2796
Vulnerability from csaf_redhat
Published
2020-07-01 18:46
Modified
2024-11-22 15:26
Summary
Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update
Notes
Topic
An update for servicemesh-grafana is now available for OpenShift Service Mesh 1.1.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
Security Fix(es):
* kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service (CVE-2019-11253)
* grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL (CVE-2020-13379)
* npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions (CVE-2019-16769)
* npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js (CVE-2020-7660)
* npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7662)
* grafana: XSS annotation popup vulnerability (CVE-2020-12052)
* grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)
* grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for servicemesh-grafana is now available for OpenShift Service Mesh 1.1.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.\n\nSecurity Fix(es):\n\n* kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service (CVE-2019-11253)\n\n* grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL (CVE-2020-13379)\n\n* npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions (CVE-2019-16769)\n\n* npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js (CVE-2020-7660)\n\n* npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7662)\n\n* grafana: XSS annotation popup vulnerability (CVE-2020-12052)\n\n* grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)\n\n* grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2796", "url": "https://access.redhat.com/errata/RHSA-2020:2796" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "1843640", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843640" }, { "category": "external", "summary": "1844228", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1844228" }, { "category": "external", "summary": "1845982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845982" }, { "category": "external", "summary": "1848089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848089" }, { "category": "external", "summary": "1848092", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848092" }, { "category": "external", "summary": "1848108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848108" }, { "category": "external", "summary": "1848643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848643" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2796.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update", "tracking": { "current_release_date": "2024-11-22T15:26:56+00:00", "generator": { "date": "2024-11-22T15:26:56+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:2796", "initial_release_date": "2020-07-01T18:46:37+00:00", "revision_history": [ { "date": "2020-07-01T18:46:37+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-01T18:46:37+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:26:56+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift Service Mesh 1.1", "product": { "name": "OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:1.1::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Service Mesh" }, { "branches": [ { "category": "product_version", "name": "servicemesh-grafana-0:6.4.3-11.el8.x86_64", "product": { "name": "servicemesh-grafana-0:6.4.3-11.el8.x86_64", "product_id": "servicemesh-grafana-0:6.4.3-11.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana@6.4.3-11.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64", "product": { "name": "servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64", "product_id": "servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana-prometheus@6.4.3-11.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "servicemesh-grafana-0:6.4.3-11.el8.src", "product": { "name": "servicemesh-grafana-0:6.4.3-11.el8.src", "product_id": "servicemesh-grafana-0:6.4.3-11.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana@6.4.3-11.el8?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-0:6.4.3-11.el8.src as a component of OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src" }, "product_reference": "servicemesh-grafana-0:6.4.3-11.el8.src", "relates_to_product_reference": "8Base-OSSM-1.1" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-0:6.4.3-11.el8.x86_64 as a component of OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64" }, "product_reference": "servicemesh-grafana-0:6.4.3-11.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.1" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64 as a component of OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" }, "product_reference": "servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.1" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-01T18:46:37+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" }, { "cve": "CVE-2019-16769", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848092" } ], "notes": [ { "category": "description", "text": "A XSS flaw was found in npm-serialize-javascript. It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js\u0027s implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable serialize-javascript library to authenticated users only, therefore the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-16769" }, { "category": "external", "summary": "RHBZ#1848092", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848092" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-16769", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16769" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-16769", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16769" } ], "release_date": "2020-05-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-01T18:46:37+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions" }, { "cve": "CVE-2020-7660", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1844228" } ], "notes": [ { "category": "description", "text": "A flaw was found in the serialize-javascript before version 3.1.0. This flaw allows remote attackers to inject arbitrary code via the function \"deleteFunctions\" within \"index.js.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay includes serialize-javascript as a dependency of webpack which is only used at build time. The vulnerable library is not used at runtime meaning this has a low impact on Red Hat Quay.\n\nThe currently supported versions of Container Native Virtualization 2 are not affected by this flaw. However, version 2.0, which is no longer supported, is affected.\n\nIn OpenShift distributed tracing there is bundled vulnerable version of the serialize-javascript Nodejs package, however access to the vulnerable function is restricted and protected by OpenShift OAuth, hence the impact by this vulnerability is reduced to Low.\n\nIn Red Hat OpenShift Logging the openshift-logging/kibana6-rhel8 container bundles many nodejs packages as a build time dependencies, including the serialize-javascript package. \nThe vulnerable code is not used hence the impact to OpenShift Logging by this vulnerability is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7660" }, { "category": "external", "summary": "RHBZ#1844228", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1844228" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7660", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7660" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7660", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7660" } ], "release_date": "2020-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-01T18:46:37+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js" }, { "cve": "CVE-2020-7662", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-06-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1845982" } ], "notes": [ { "category": "description", "text": "websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.", "title": "Vulnerability description" }, { "category": "summary", "text": "npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable websocket-extension to authenticated users only, therefore the impact is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7662" }, { "category": "external", "summary": "RHBZ#1845982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845982" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7662", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7662" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7662", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7662" }, { "category": "external", "summary": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv", "url": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv" } ], "release_date": "2020-06-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-01T18:46:37+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser" }, { "cve": "CVE-2020-12052", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848089" } ], "notes": [ { "category": "description", "text": "A flaw was found in grafana. The software is vulnerable to an annotation popup XSS.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS annotation popup vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the version of the grafana package as shipped with Red Hat Ceph Storage (RHCS) version 2. Ceph-2 has reached End of Extended Life Cycle Support and no longer fixing moderates/lows.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-12052" }, { "category": "external", "summary": "RHBZ#1848089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848089" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-12052", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12052" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12052", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12052" } ], "release_date": "2020-04-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-01T18:46:37+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: XSS annotation popup vulnerability" }, { "cve": "CVE-2020-12245", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848643" } ], "notes": [ { "category": "description", "text": "A flaw was found in grafana. A XSS is possible in table-panel via column.title or cellLinkTooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS via column.title or cellLinkTooltip", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-12245" }, { "category": "external", "summary": "RHBZ#1848643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848643" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-12245", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12245" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12245", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12245" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-01T18:46:37+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: XSS via column.title or cellLinkTooltip" }, { "cve": "CVE-2020-13379", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "discovery_date": "2020-06-03T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1843640" } ], "notes": [ { "category": "description", "text": "An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the same issue can create a NULL pointer dereference vulnerability. This flaw allows an attacker to gain information about the network that Grafana is running on, or cause a segmentation fault, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the Grafana containers are behind OpenShift OAuth restricting access to the vulnerable path to authenticated users only. However, other pods may still access the vulnerable URL within the cluster. Therefore the impact is moderate for both (OCP and OSSM).\n\nRed Hat Ceph Storage 2 is now in Extended Life Support (ELS) Phase of the support. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Ceph Storage Life Cycle: https://access.redhat.com/support/policy/updates/ceph-storage", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-13379" }, { "category": "external", "summary": "RHBZ#1843640", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843640" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-13379", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13379" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13379", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13379" }, { "category": "external", "summary": "https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/", "url": "https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2020/06/09/2/", "url": "https://www.openwall.com/lists/oss-security/2020/06/09/2/" } ], "release_date": "2020-06-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-01T18:46:37+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" }, { "category": "workaround", "details": "This issue can be mitigated by blocking access to the URL path /avatar/*, through a method such as a reverse proxy, load balancer, application firewall etc.", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL" }, { "cve": "CVE-2020-13430", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848108" } ], "notes": [ { "category": "description", "text": "A flaw was found in grafana Tag value XSS via the OpenTSDB datasource are possible. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS via the OpenTSDB datasource", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Ceph Storage (RHCS) delivers the affected code of the grafana OpenTSDB plugin. However Red Hat Ceph Storage uses the Prometheus time-series database as a default data source not the OpenTSDB, hence the impact by this vulnerability is set to low.\n\nRed Hat Gluster Storage (RHGS) delivers the affected code of the grafana OpenTSDB plugin. However Red Hat Gluster Storage uses the Graphite as a data source not the OpenTSDB, hence the impact by this vulnerability is set to low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-13430" }, { "category": "external", "summary": "RHBZ#1848108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848108" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-13430", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13430" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13430", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13430" } ], "release_date": "2020-05-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-01T18:46:37+00:00", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: XSS via the OpenTSDB datasource" } ] }
ghsa-pmqp-h87c-mr78
Vulnerability from github
Published
2021-05-18 15:38
Modified
2023-09-29 15:22
Severity ?
Summary
XML Entity Expansion and Improper Input Validation in Kubernetes API server
Details
Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.
Specific Go Packages Affected
k8s.io/kubernetes/pkg/apiserver
{ "affected": [ { "package": { "ecosystem": "Go", "name": "k8s.io/kubernetes" }, "ranges": [ { "events": [ { "introduced": "1.0.0" }, { "fixed": "1.13.12" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Go", "name": "k8s.io/kubernetes" }, "ranges": [ { "events": [ { "introduced": "1.14.0" }, { "fixed": "1.14.8" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Go", "name": "k8s.io/kubernetes" }, "ranges": [ { "events": [ { "introduced": "1.15.0" }, { "fixed": "1.15.5" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Go", "name": "k8s.io/kubernetes" }, "ranges": [ { "events": [ { "introduced": "1.16.0" }, { "fixed": "1.16.2" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2019-11253" ], "database_specific": { "cwe_ids": [ "CWE-20", "CWE-776" ], "github_reviewed": true, "github_reviewed_at": "2021-05-17T21:06:33Z", "nvd_published_at": null, "severity": "HIGH" }, "details": "Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.\n\n### Specific Go Packages Affected\nk8s.io/kubernetes/pkg/apiserver", "id": "GHSA-pmqp-h87c-mr78", "modified": "2023-09-29T15:22:47Z", "published": "2021-05-18T15:38:48Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "type": "WEB", "url": "https://github.com/kubernetes/kubernetes/issues/83253" }, { "type": "WEB", "url": "https://github.com/kubernetes/kubernetes/pull/83261" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:3239" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:3811" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:3905" }, { "type": "WEB", "url": "https://gist.github.com/bgeesaman/0e0349e94cd22c48bf14d8a9b7d6b8f2" }, { "type": "WEB", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/jk8polzSUxs" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20191031-0006" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "XML Entity Expansion and Improper Input Validation in Kubernetes API server" }
gsd-2019-11253
Vulnerability from gsd
Modified
2023-12-13 01:24
Details
Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2019-11253", "description": "Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.", "id": "GSD-2019-11253", "references": [ "https://www.suse.com/security/cve/CVE-2019-11253.html", "https://access.redhat.com/errata/RHSA-2020:2870", "https://access.redhat.com/errata/RHSA-2020:2863", "https://access.redhat.com/errata/RHSA-2020:2861", "https://access.redhat.com/errata/RHSA-2020:2799", "https://access.redhat.com/errata/RHSA-2020:2796", "https://access.redhat.com/errata/RHSA-2020:2795", "https://access.redhat.com/errata/RHSA-2019:3905", "https://access.redhat.com/errata/RHSA-2019:3811", "https://access.redhat.com/errata/RHEA-2019:3809", "https://access.redhat.com/errata/RHSA-2019:3239", "https://access.redhat.com/errata/RHSA-2019:3132", "https://linux.oracle.com/cve/CVE-2019-11253.html", "https://access.redhat.com/errata/RHSA-2022:2183" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2019-11253" ], "details": "Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.", "id": "GSD-2019-11253", "modified": "2023-12-13T01:24:02.122584Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "AKA": "", "ASSIGNER": "security@kubernetes.io", "DATE_PUBLIC": "2019-09-27", "ID": "CVE-2019-11253", "STATE": "PUBLIC", "TITLE": "Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Kubernetes", "version": { "version_data": [ { "platform": "", "version_affected": "", "version_name": "", "version_value": "prior to 1.13.12" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "prior to 1.14.8" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "prior to 1.15.5" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "prior to 1.16.2" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.1" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.2" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.3" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.4" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.5" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.6" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.7" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.8" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.9" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.10" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.11" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.12" } ] } } ] }, "vendor_name": "Kubernetes" } ] } }, "configuration": [], "credit": [ { "lang": "eng", "value": "Rory McCune" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility." } ] }, "exploit": [], "generator": { "engine": "Vulnogram 0.0.7" }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-20: Improper Input Validation" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/kubernetes/kubernetes/issues/83253", "refsource": "CONFIRM", "url": "https://github.com/kubernetes/kubernetes/issues/83253" }, { "name": "CVE-2019-11253: denial of service vulnerability from malicious YAML or JSON payloads", "refsource": "MLIST", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/jk8polzSUxs" }, { "name": "RHSA-2019:3239", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3239" }, { "name": "https://security.netapp.com/advisory/ntap-20191031-0006/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20191031-0006/" }, { "name": "RHSA-2019:3811", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3811" }, { "name": "RHSA-2019:3905", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3905" } ] }, "solution": [], "source": { "advisory": "", "defect": [ "https://github.com/kubernetes/kubernetes/issues/83253" ], "discovery": "USER" }, "work_around": [ { "lang": "eng", "value": "Exposure to requests from unauthenticated users can be mitigated by removing all write permissions from unauthenticated users, following instructions at https://github.com/kubernetes/kubernetes/issues/83253" } ] }, "gitlab.com": { "advisories": [ { "affected_range": "\u003e=1.0.0 \u003c1.13.12||\u003e=1.14.0 \u003c1.14.8||\u003e=1.15.0 \u003c1.15.5||\u003e=1.16.0 \u003c1.16.2", "affected_versions": "All versions starting from 1.0.0 before 1.13.12, all versions starting from 1.14.0 before 1.14.8, all versions starting from 1.15.0 before 1.15.5, all versions starting from 1.16.0 before 1.16.2", "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cwe_ids": [ "CWE-1035", "CWE-776", "CWE-937" ], "date": "2021-05-18", "description": "Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.", "fixed_versions": [ "1.13.12", "1.14.8", "1.15.5", "1.16.2" ], "identifier": "CVE-2019-11253", "identifiers": [ "GHSA-pmqp-h87c-mr78", "CVE-2019-11253" ], "not_impacted": "All versions before 1.0.0, all versions starting from 1.13.12 before 1.14.0, all versions starting from 1.14.8 before 1.15.0, all versions starting from 1.15.5 before 1.16.0, all versions starting from 1.16.2", "package_slug": "go/k8s.io/kubernetes/pkg/apiserver", "pubdate": "2021-05-18", "solution": "Upgrade to versions 1.13.12, 1.14.8, 1.15.5, 1.16.2 or above.", "title": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "https://github.com/kubernetes/kubernetes/issues/83253", "https://github.com/kubernetes/kubernetes/pull/83261", "https://gist.github.com/bgeesaman/0e0349e94cd22c48bf14d8a9b7d6b8f2", "https://github.com/advisories/GHSA-pmqp-h87c-mr78" ], "uuid": "2037b20e-2435-448a-9128-8690791df7ed" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "1.12.10", "versionStartIncluding": "1.1.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.14.8", "versionStartIncluding": "1.14.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.13.2", "versionStartIncluding": "1.13.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.16.2", "versionStartIncluding": "1.16.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.15.5", "versionStartIncluding": "1.15.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:3.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "security@kubernetes.io", "ID": "CVE-2019-11253" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-776" } ] } ] }, "references": { "reference_data": [ { "name": "CVE-2019-11253: denial of service vulnerability from malicious YAML or JSON payloads", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/jk8polzSUxs" }, { "name": "https://github.com/kubernetes/kubernetes/issues/83253", "refsource": "CONFIRM", "tags": [ "Exploit", "Issue Tracking", "Mitigation", "Third Party Advisory" ], "url": "https://github.com/kubernetes/kubernetes/issues/83253" }, { "name": "RHSA-2019:3239", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:3239" }, { "name": "https://security.netapp.com/advisory/ntap-20191031-0006/", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://security.netapp.com/advisory/ntap-20191031-0006/" }, { "name": "RHSA-2019:3811", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:3811" }, { "name": "RHSA-2019:3905", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2019:3905" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } }, "lastModifiedDate": "2020-10-02T17:11Z", "publishedDate": "2019-10-17T16:15Z" } } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.