Action not permitted
Modal body text goes here.
CVE-2019-19794
Vulnerability from cvelistv5
Published
2019-12-13 21:46
Modified
2024-08-05 02:25
Severity ?
EPSS score ?
Summary
The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/coredns/coredns/issues/3519 | Issue Tracking, Third Party Advisory | |
| cve@mitre.org | https://github.com/coredns/coredns/issues/3547 | Third Party Advisory | |
| cve@mitre.org | https://github.com/miekg/dns/compare/v1.1.24...v1.1.25 | Release Notes, Third Party Advisory | |
| cve@mitre.org | https://github.com/miekg/dns/issues/1043 | Exploit, Issue Tracking, Third Party Advisory | |
| cve@mitre.org | https://github.com/miekg/dns/pull/1044 | Patch, Third Party Advisory |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T02:25:12.686Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/miekg/dns/issues/1043"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/coredns/coredns/issues/3519"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/miekg/dns/pull/1044"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/miekg/dns/compare/v1.1.24...v1.1.25"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/coredns/coredns/issues/3547"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-18T04:01:37",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/miekg/dns/issues/1043"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/coredns/coredns/issues/3519"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/miekg/dns/pull/1044"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/miekg/dns/compare/v1.1.24...v1.1.25"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/coredns/coredns/issues/3547"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-19794",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/miekg/dns/issues/1043",
"refsource": "MISC",
"url": "https://github.com/miekg/dns/issues/1043"
},
{
"name": "https://github.com/coredns/coredns/issues/3519",
"refsource": "MISC",
"url": "https://github.com/coredns/coredns/issues/3519"
},
{
"name": "https://github.com/miekg/dns/pull/1044",
"refsource": "MISC",
"url": "https://github.com/miekg/dns/pull/1044"
},
{
"name": "https://github.com/miekg/dns/compare/v1.1.24...v1.1.25",
"refsource": "MISC",
"url": "https://github.com/miekg/dns/compare/v1.1.24...v1.1.25"
},
{
"name": "https://github.com/coredns/coredns/issues/3547",
"refsource": "CONFIRM",
"url": "https://github.com/coredns/coredns/issues/3547"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-19794",
"datePublished": "2019-12-13T21:46:59",
"dateReserved": "2019-12-13T00:00:00",
"dateUpdated": "2024-08-05T02:25:12.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2019-19794\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-12-13T22:15:11.357\",\"lastModified\":\"2020-01-02T17:36:47.200\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.\"},{\"lang\":\"es\",\"value\":\"El paquete DNS de miekg Go versiones anteriores a la versi\u00f3n 1.1.25, como es usado en CoreDNS versiones anteriores a la versi\u00f3n 1.6.6 y otros productos, genera n\u00fameros aleatorios inapropiadamente porque math/rand es usado. El TXID se vuelve predecible, conllevando a falsificaciones de respuesta.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-338\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:miekg-dns_project:miekg-dns:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.1.25\",\"matchCriteriaId\":\"0F0F7709-230B-4274-AF38-B3704AD451AB\"}]}]}],\"references\":[{\"url\":\"https://github.com/coredns/coredns/issues/3519\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/coredns/coredns/issues/3547\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/miekg/dns/compare/v1.1.24...v1.1.25\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/miekg/dns/issues/1043\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/miekg/dns/pull/1044\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}"
}
}
rhsa-2022_2183
Vulnerability from csaf_redhat
Published
2022-05-11 11:33
Modified
2024-11-25 16:25
Summary
Red Hat Security Advisory: Release of containers for OSP 16.2.z director operator tech preview
Notes
Topic
Red Hat OpenStack Platform 16.2 (Train) director Operator containers are
available for technology preview.
Details
Release osp-director-operator images
Security Fix(es):
* golang: kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote (CVE-2019-11253)
* golang: golang-github-miekg-dns: predictable TXID can lead to response forgeries (CVE-2019-19794)
* golang: containerd: unrestricted access to abstract Unix domain socket can lead to privileges (CVE-2020-15257)
* golang: ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)
* golang: containerd: pulling and extracting crafted container image may result in Unix file permission changes (CVE-2021-32760)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenStack Platform 16.2 (Train) director Operator containers are\navailable for technology preview.",
"title": "Topic"
},
{
"category": "general",
"text": "Release osp-director-operator images\n\nSecurity Fix(es):\n\n* golang: kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote (CVE-2019-11253)\n* golang: golang-github-miekg-dns: predictable TXID can lead to response forgeries (CVE-2019-19794)\n* golang: containerd: unrestricted access to abstract Unix domain socket can lead to privileges (CVE-2020-15257)\n* golang: ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)\n* golang: containerd: pulling and extracting crafted container image may result in Unix file permission changes (CVE-2021-32760)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2022:2183",
"url": "https://access.redhat.com/errata/RHSA-2022:2183"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1757701",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701"
},
{
"category": "external",
"summary": "1786761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1786761"
},
{
"category": "external",
"summary": "1899487",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1899487"
},
{
"category": "external",
"summary": "1954368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954368"
},
{
"category": "external",
"summary": "1982681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982681"
},
{
"category": "external",
"summary": "2079447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2079447"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_2183.json"
}
],
"title": "Red Hat Security Advisory: Release of containers for OSP 16.2.z director operator tech preview",
"tracking": {
"current_release_date": "2024-11-25T16:25:41+00:00",
"generator": {
"date": "2024-11-25T16:25:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2022:2183",
"initial_release_date": "2022-05-11T11:33:14+00:00",
"revision_history": [
{
"date": "2022-05-11T11:33:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2022-05-11T11:33:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-25T16:25:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 16.2",
"product": {
"name": "Red Hat OpenStack Platform 16.2",
"product_id": "8Base-RHOS-16.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:16.2::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"product": {
"name": "rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"product_id": "rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb?arch=amd64\u0026repository_url=registry.redhat.io/rhosp-rhel8-tech-preview/osp-director-downloader\u0026tag=1.2.3-2"
}
}
},
{
"category": "product_version",
"name": "rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64",
"product": {
"name": "rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64",
"product_id": "rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d?arch=amd64\u0026repository_url=registry.redhat.io/rhosp-rhel8-tech-preview/osp-director-operator-bundle\u0026tag=1.2.3-3"
}
}
},
{
"category": "product_version",
"name": "rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64",
"product": {
"name": "rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64",
"product_id": "rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64",
"product_identification_helper": {
"purl": "pkg:oci/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56?arch=amd64\u0026repository_url=registry.redhat.io/rhosp-rhel8-tech-preview/osp-director-operator\u0026tag=1.2.3-2"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64 as a component of Red Hat OpenStack Platform 16.2",
"product_id": "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64"
},
"product_reference": "rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"relates_to_product_reference": "8Base-RHOS-16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64 as a component of Red Hat OpenStack Platform 16.2",
"product_id": "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64"
},
"product_reference": "rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64",
"relates_to_product_reference": "8Base-RHOS-16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64 as a component of Red Hat OpenStack Platform 16.2",
"product_id": "8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
},
"product_reference": "rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64",
"relates_to_product_reference": "8Base-RHOS-16.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-11253",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2019-10-01T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1757701"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
],
"known_not_affected": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-11253"
},
{
"category": "external",
"summary": "RHBZ#1757701",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11253"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253"
},
{
"category": "external",
"summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/",
"url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/"
}
],
"release_date": "2019-09-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-05-11T11:33:14+00:00",
"details": "OSP 16.2 Release - OSP Director Operator Containers tech preview",
"product_ids": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:2183"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service"
},
{
"cve": "CVE-2019-19794",
"cwe": {
"id": "CWE-338",
"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2019-12-27T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1786761"
}
],
"notes": [
{
"category": "description",
"text": "The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang-github-miekg-dns: predictable TXID can lead to response forgeries",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
],
"known_not_affected": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-19794"
},
{
"category": "external",
"summary": "RHBZ#1786761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1786761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-19794",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19794"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-19794",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19794"
}
],
"release_date": "2019-12-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-05-11T11:33:14+00:00",
"details": "OSP 16.2 Release - OSP Director Operator Containers tech preview",
"product_ids": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:2183"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang-github-miekg-dns: predictable TXID can lead to response forgeries"
},
{
"cve": "CVE-2020-15257",
"cwe": {
"id": "CWE-269",
"name": "Improper Privilege Management"
},
"discovery_date": "2020-11-17T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1899487"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd. Access controls for the shim\u0027s API socket verified that a connecting process had an effective UID of 0, but otherwise did not restrict access to the abstract Unix domain socket. This could allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "containerd: unrestricted access to abstract Unix domain socket can lead to privileges escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "* The container runtime in OpenShift Container Platform 4 is cri-o which is not affected by this flaw. It doesn\u0027t make use of abstract unix sockets like containerd, which lead to this vulnerability being possible.\n\n* Red Hat Advanced Cluster Management for Kubernetes is not affected by this flaw. While containerd is included in the multicloud-operators-subscription image as a dependency of helm, it is not used in any way that exposes the abstract unix socket that is involved in this vulnerability.\n\n* The container-tools module in Red Hat Enterprise Linux is not affected by this flaw as these packages do not use abstract unix sockets for container management.\n\n* For Red Hat OpenStack Platform, because containerd is not actually used in director-operator, the RHOSP Impact has been moved to Low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
],
"known_not_affected": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-15257"
},
{
"category": "external",
"summary": "RHBZ#1899487",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1899487"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-15257",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15257"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15257",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15257"
}
],
"release_date": "2020-11-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-05-11T11:33:14+00:00",
"details": "OSP 16.2 Release - OSP Director Operator Containers tech preview",
"product_ids": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:2183"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "containerd: unrestricted access to abstract Unix domain socket can lead to privileges escalation"
},
{
"cve": "CVE-2021-29482",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2021-04-28T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1954368"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in github.com/ulikunitz/xz. The function readUvarint may not terminate a loop what could lead to denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ulikunitz/xz: Infinite loop in readUvarint allows for denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth authentication, therefore the impact is low.\nIn OCP before 4.7 the buildah, skopeo and podman packages include vulnerable version of github.com/ulikunitz/xz, but these OCP releases are already in the Maintenance Phase of the support, hence affected components are marked as wontfix. This may be fixed in the future.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
],
"known_not_affected": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-29482"
},
{
"category": "external",
"summary": "RHBZ#1954368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954368"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-29482",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29482"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-29482",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29482"
}
],
"release_date": "2020-08-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-05-11T11:33:14+00:00",
"details": "OSP 16.2 Release - OSP Director Operator Containers tech preview",
"product_ids": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:2183"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ulikunitz/xz: Infinite loop in readUvarint allows for denial of service"
},
{
"acknowledgments": [
{
"names": [
"distros"
],
"organization": "distros"
}
],
"cve": "CVE-2021-32760",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2021-07-13T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1982681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host\u2019s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "containerd: pulling and extracting crafted container image may result in Unix file permission changes",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
],
"known_not_affected": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-downloader@sha256:d3915d621da43f74f177a3dd416fb89e3bb66dd58d2d915243fcf6102ffc9fdb_amd64",
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator-bundle@sha256:dcf25f95c2a758e097d1e344d6f46b43b6050b6f4a70587eacee34430823595d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-32760"
},
{
"category": "external",
"summary": "RHBZ#1982681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-32760",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32760"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32760",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32760"
}
],
"release_date": "2021-07-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-05-11T11:33:14+00:00",
"details": "OSP 16.2 Release - OSP Director Operator Containers tech preview",
"product_ids": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:2183"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-RHOS-16.2:rhosp-rhel8-tech-preview/osp-director-operator@sha256:95957e8ab5c45d5bcf35f8c59d5748e3ed8d5ab2db0d46fce46b376217e23d56_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "containerd: pulling and extracting crafted container image may result in Unix file permission changes"
}
]
}
rhsa-2020_5198
Vulnerability from csaf_redhat
Published
2020-11-24 09:02
Modified
2024-11-25 12:16
Summary
Red Hat Security Advisory: Red Hat OpenShift Jaeger security update
Notes
Topic
An update is now available for Red Hat OpenShift Jaeger 1.20.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Jaeger is Red Hat's distribution of the Jaeger project,
tailored for installation into an on-premise OpenShift Container Platform
installation.
Security Fix(es):
* golang-github-miekg-dns: predictable TXID can lead to response forgeries (CVE-2019-19794)
* golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat OpenShift Jaeger 1.20.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Jaeger is Red Hat\u0027s distribution of the Jaeger project,\ntailored for installation into an on-premise OpenShift Container Platform\ninstallation.\n\nSecurity Fix(es):\n\n* golang-github-miekg-dns: predictable TXID can lead to response forgeries (CVE-2019-19794)\n\n* golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:5198",
"url": "https://access.redhat.com/errata/RHSA-2020:5198"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1786761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1786761"
},
{
"category": "external",
"summary": "1853652",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1853652"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5198.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift Jaeger security update",
"tracking": {
"current_release_date": "2024-11-25T12:16:25+00:00",
"generator": {
"date": "2024-11-25T12:16:25+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2020:5198",
"initial_release_date": "2020-11-24T09:02:25+00:00",
"revision_history": [
{
"date": "2020-11-24T09:02:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-11-24T09:02:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-25T12:16:25+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Jaeger 1.20",
"product": {
"name": "Red Hat OpenShift Jaeger 1.20",
"product_id": "8Base-JAEGER-1.20",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jaeger:1.20::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Jaeger"
},
{
"branches": [
{
"category": "product_version",
"name": "distributed-tracing/jaeger-agent-rhel8@sha256:b865eafd2ca6f1973115f76d9dfcc95dc734115797208af0be6f08dcb9a5a9e3_amd64",
"product": {
"name": "distributed-tracing/jaeger-agent-rhel8@sha256:b865eafd2ca6f1973115f76d9dfcc95dc734115797208af0be6f08dcb9a5a9e3_amd64",
"product_id": "distributed-tracing/jaeger-agent-rhel8@sha256:b865eafd2ca6f1973115f76d9dfcc95dc734115797208af0be6f08dcb9a5a9e3_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jaeger-agent-rhel8@sha256:b865eafd2ca6f1973115f76d9dfcc95dc734115797208af0be6f08dcb9a5a9e3?arch=amd64\u0026repository_url=registry.redhat.io/distributed-tracing/jaeger-agent-rhel8\u0026tag=1.20.1-3"
}
}
},
{
"category": "product_version",
"name": "distributed-tracing/jaeger-all-in-one-rhel8@sha256:dab400d79fd6b6b0bc328003756eb4434bb07ded74973ca09d584a4623e7498b_amd64",
"product": {
"name": "distributed-tracing/jaeger-all-in-one-rhel8@sha256:dab400d79fd6b6b0bc328003756eb4434bb07ded74973ca09d584a4623e7498b_amd64",
"product_id": "distributed-tracing/jaeger-all-in-one-rhel8@sha256:dab400d79fd6b6b0bc328003756eb4434bb07ded74973ca09d584a4623e7498b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jaeger-all-in-one-rhel8@sha256:dab400d79fd6b6b0bc328003756eb4434bb07ded74973ca09d584a4623e7498b?arch=amd64\u0026repository_url=registry.redhat.io/distributed-tracing/jaeger-all-in-one-rhel8\u0026tag=1.20.1-3"
}
}
},
{
"category": "product_version",
"name": "distributed-tracing/jaeger-collector-rhel8@sha256:08a9fb69f64617ef399f3baa9f649fd0b33ba4f65afa15d36630825b1417d083_amd64",
"product": {
"name": "distributed-tracing/jaeger-collector-rhel8@sha256:08a9fb69f64617ef399f3baa9f649fd0b33ba4f65afa15d36630825b1417d083_amd64",
"product_id": "distributed-tracing/jaeger-collector-rhel8@sha256:08a9fb69f64617ef399f3baa9f649fd0b33ba4f65afa15d36630825b1417d083_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jaeger-collector-rhel8@sha256:08a9fb69f64617ef399f3baa9f649fd0b33ba4f65afa15d36630825b1417d083?arch=amd64\u0026repository_url=registry.redhat.io/distributed-tracing/jaeger-collector-rhel8\u0026tag=1.20.1-3"
}
}
},
{
"category": "product_version",
"name": "distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:368c464d25c0e7105fac06d868dbaf22aad0e5d0b131ede0158350b1097c2530_amd64",
"product": {
"name": "distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:368c464d25c0e7105fac06d868dbaf22aad0e5d0b131ede0158350b1097c2530_amd64",
"product_id": "distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:368c464d25c0e7105fac06d868dbaf22aad0e5d0b131ede0158350b1097c2530_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jaeger-es-index-cleaner-rhel8@sha256:368c464d25c0e7105fac06d868dbaf22aad0e5d0b131ede0158350b1097c2530?arch=amd64\u0026repository_url=registry.redhat.io/distributed-tracing/jaeger-es-index-cleaner-rhel8\u0026tag=1.20.1-3"
}
}
},
{
"category": "product_version",
"name": "distributed-tracing/jaeger-es-rollover-rhel8@sha256:dee668b9269ffd46e3fb599f86161e5efa5e8a87cbad4586d30d5f9bf4d6882a_amd64",
"product": {
"name": "distributed-tracing/jaeger-es-rollover-rhel8@sha256:dee668b9269ffd46e3fb599f86161e5efa5e8a87cbad4586d30d5f9bf4d6882a_amd64",
"product_id": "distributed-tracing/jaeger-es-rollover-rhel8@sha256:dee668b9269ffd46e3fb599f86161e5efa5e8a87cbad4586d30d5f9bf4d6882a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jaeger-es-rollover-rhel8@sha256:dee668b9269ffd46e3fb599f86161e5efa5e8a87cbad4586d30d5f9bf4d6882a?arch=amd64\u0026repository_url=registry.redhat.io/distributed-tracing/jaeger-es-rollover-rhel8\u0026tag=1.20.1-3"
}
}
},
{
"category": "product_version",
"name": "distributed-tracing/jaeger-ingester-rhel8@sha256:8d006439b8629e2f3f790132aa2da22461ad373174252bf07293bad977010599_amd64",
"product": {
"name": "distributed-tracing/jaeger-ingester-rhel8@sha256:8d006439b8629e2f3f790132aa2da22461ad373174252bf07293bad977010599_amd64",
"product_id": "distributed-tracing/jaeger-ingester-rhel8@sha256:8d006439b8629e2f3f790132aa2da22461ad373174252bf07293bad977010599_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jaeger-ingester-rhel8@sha256:8d006439b8629e2f3f790132aa2da22461ad373174252bf07293bad977010599?arch=amd64\u0026repository_url=registry.redhat.io/distributed-tracing/jaeger-ingester-rhel8\u0026tag=1.20.1-3"
}
}
},
{
"category": "product_version",
"name": "distributed-tracing/jaeger-query-rhel8@sha256:73d2a132ec00dc7db60081fc428b259c08731ec78fc9b2aa70eb8513739955da_amd64",
"product": {
"name": "distributed-tracing/jaeger-query-rhel8@sha256:73d2a132ec00dc7db60081fc428b259c08731ec78fc9b2aa70eb8513739955da_amd64",
"product_id": "distributed-tracing/jaeger-query-rhel8@sha256:73d2a132ec00dc7db60081fc428b259c08731ec78fc9b2aa70eb8513739955da_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jaeger-query-rhel8@sha256:73d2a132ec00dc7db60081fc428b259c08731ec78fc9b2aa70eb8513739955da?arch=amd64\u0026repository_url=registry.redhat.io/distributed-tracing/jaeger-query-rhel8\u0026tag=1.20.1-3"
}
}
},
{
"category": "product_version",
"name": "distributed-tracing/jaeger-rhel8-operator@sha256:41a9209a1c04be67045966edfef822d464ca75b96ac488a1e8557980f0ca0a1c_amd64",
"product": {
"name": "distributed-tracing/jaeger-rhel8-operator@sha256:41a9209a1c04be67045966edfef822d464ca75b96ac488a1e8557980f0ca0a1c_amd64",
"product_id": "distributed-tracing/jaeger-rhel8-operator@sha256:41a9209a1c04be67045966edfef822d464ca75b96ac488a1e8557980f0ca0a1c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jaeger-rhel8-operator@sha256:41a9209a1c04be67045966edfef822d464ca75b96ac488a1e8557980f0ca0a1c?arch=amd64\u0026repository_url=registry.redhat.io/distributed-tracing/jaeger-rhel8-operator\u0026tag=1.20.1-3"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "distributed-tracing/jaeger-agent-rhel8@sha256:b865eafd2ca6f1973115f76d9dfcc95dc734115797208af0be6f08dcb9a5a9e3_amd64 as a component of Red Hat OpenShift Jaeger 1.20",
"product_id": "8Base-JAEGER-1.20:distributed-tracing/jaeger-agent-rhel8@sha256:b865eafd2ca6f1973115f76d9dfcc95dc734115797208af0be6f08dcb9a5a9e3_amd64"
},
"product_reference": "distributed-tracing/jaeger-agent-rhel8@sha256:b865eafd2ca6f1973115f76d9dfcc95dc734115797208af0be6f08dcb9a5a9e3_amd64",
"relates_to_product_reference": "8Base-JAEGER-1.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distributed-tracing/jaeger-all-in-one-rhel8@sha256:dab400d79fd6b6b0bc328003756eb4434bb07ded74973ca09d584a4623e7498b_amd64 as a component of Red Hat OpenShift Jaeger 1.20",
"product_id": "8Base-JAEGER-1.20:distributed-tracing/jaeger-all-in-one-rhel8@sha256:dab400d79fd6b6b0bc328003756eb4434bb07ded74973ca09d584a4623e7498b_amd64"
},
"product_reference": "distributed-tracing/jaeger-all-in-one-rhel8@sha256:dab400d79fd6b6b0bc328003756eb4434bb07ded74973ca09d584a4623e7498b_amd64",
"relates_to_product_reference": "8Base-JAEGER-1.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distributed-tracing/jaeger-collector-rhel8@sha256:08a9fb69f64617ef399f3baa9f649fd0b33ba4f65afa15d36630825b1417d083_amd64 as a component of Red Hat OpenShift Jaeger 1.20",
"product_id": "8Base-JAEGER-1.20:distributed-tracing/jaeger-collector-rhel8@sha256:08a9fb69f64617ef399f3baa9f649fd0b33ba4f65afa15d36630825b1417d083_amd64"
},
"product_reference": "distributed-tracing/jaeger-collector-rhel8@sha256:08a9fb69f64617ef399f3baa9f649fd0b33ba4f65afa15d36630825b1417d083_amd64",
"relates_to_product_reference": "8Base-JAEGER-1.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:368c464d25c0e7105fac06d868dbaf22aad0e5d0b131ede0158350b1097c2530_amd64 as a component of Red Hat OpenShift Jaeger 1.20",
"product_id": "8Base-JAEGER-1.20:distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:368c464d25c0e7105fac06d868dbaf22aad0e5d0b131ede0158350b1097c2530_amd64"
},
"product_reference": "distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:368c464d25c0e7105fac06d868dbaf22aad0e5d0b131ede0158350b1097c2530_amd64",
"relates_to_product_reference": "8Base-JAEGER-1.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distributed-tracing/jaeger-es-rollover-rhel8@sha256:dee668b9269ffd46e3fb599f86161e5efa5e8a87cbad4586d30d5f9bf4d6882a_amd64 as a component of Red Hat OpenShift Jaeger 1.20",
"product_id": "8Base-JAEGER-1.20:distributed-tracing/jaeger-es-rollover-rhel8@sha256:dee668b9269ffd46e3fb599f86161e5efa5e8a87cbad4586d30d5f9bf4d6882a_amd64"
},
"product_reference": "distributed-tracing/jaeger-es-rollover-rhel8@sha256:dee668b9269ffd46e3fb599f86161e5efa5e8a87cbad4586d30d5f9bf4d6882a_amd64",
"relates_to_product_reference": "8Base-JAEGER-1.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distributed-tracing/jaeger-ingester-rhel8@sha256:8d006439b8629e2f3f790132aa2da22461ad373174252bf07293bad977010599_amd64 as a component of Red Hat OpenShift Jaeger 1.20",
"product_id": "8Base-JAEGER-1.20:distributed-tracing/jaeger-ingester-rhel8@sha256:8d006439b8629e2f3f790132aa2da22461ad373174252bf07293bad977010599_amd64"
},
"product_reference": "distributed-tracing/jaeger-ingester-rhel8@sha256:8d006439b8629e2f3f790132aa2da22461ad373174252bf07293bad977010599_amd64",
"relates_to_product_reference": "8Base-JAEGER-1.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distributed-tracing/jaeger-query-rhel8@sha256:73d2a132ec00dc7db60081fc428b259c08731ec78fc9b2aa70eb8513739955da_amd64 as a component of Red Hat OpenShift Jaeger 1.20",
"product_id": "8Base-JAEGER-1.20:distributed-tracing/jaeger-query-rhel8@sha256:73d2a132ec00dc7db60081fc428b259c08731ec78fc9b2aa70eb8513739955da_amd64"
},
"product_reference": "distributed-tracing/jaeger-query-rhel8@sha256:73d2a132ec00dc7db60081fc428b259c08731ec78fc9b2aa70eb8513739955da_amd64",
"relates_to_product_reference": "8Base-JAEGER-1.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distributed-tracing/jaeger-rhel8-operator@sha256:41a9209a1c04be67045966edfef822d464ca75b96ac488a1e8557980f0ca0a1c_amd64 as a component of Red Hat OpenShift Jaeger 1.20",
"product_id": "8Base-JAEGER-1.20:distributed-tracing/jaeger-rhel8-operator@sha256:41a9209a1c04be67045966edfef822d464ca75b96ac488a1e8557980f0ca0a1c_amd64"
},
"product_reference": "distributed-tracing/jaeger-rhel8-operator@sha256:41a9209a1c04be67045966edfef822d464ca75b96ac488a1e8557980f0ca0a1c_amd64",
"relates_to_product_reference": "8Base-JAEGER-1.20"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-19794",
"cwe": {
"id": "CWE-338",
"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2019-12-27T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-JAEGER-1.20:distributed-tracing/jaeger-agent-rhel8@sha256:b865eafd2ca6f1973115f76d9dfcc95dc734115797208af0be6f08dcb9a5a9e3_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-all-in-one-rhel8@sha256:dab400d79fd6b6b0bc328003756eb4434bb07ded74973ca09d584a4623e7498b_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-collector-rhel8@sha256:08a9fb69f64617ef399f3baa9f649fd0b33ba4f65afa15d36630825b1417d083_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:368c464d25c0e7105fac06d868dbaf22aad0e5d0b131ede0158350b1097c2530_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-es-rollover-rhel8@sha256:dee668b9269ffd46e3fb599f86161e5efa5e8a87cbad4586d30d5f9bf4d6882a_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-ingester-rhel8@sha256:8d006439b8629e2f3f790132aa2da22461ad373174252bf07293bad977010599_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-query-rhel8@sha256:73d2a132ec00dc7db60081fc428b259c08731ec78fc9b2aa70eb8513739955da_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1786761"
}
],
"notes": [
{
"category": "description",
"text": "The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang-github-miekg-dns: predictable TXID can lead to response forgeries",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-JAEGER-1.20:distributed-tracing/jaeger-rhel8-operator@sha256:41a9209a1c04be67045966edfef822d464ca75b96ac488a1e8557980f0ca0a1c_amd64"
],
"known_not_affected": [
"8Base-JAEGER-1.20:distributed-tracing/jaeger-agent-rhel8@sha256:b865eafd2ca6f1973115f76d9dfcc95dc734115797208af0be6f08dcb9a5a9e3_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-all-in-one-rhel8@sha256:dab400d79fd6b6b0bc328003756eb4434bb07ded74973ca09d584a4623e7498b_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-collector-rhel8@sha256:08a9fb69f64617ef399f3baa9f649fd0b33ba4f65afa15d36630825b1417d083_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:368c464d25c0e7105fac06d868dbaf22aad0e5d0b131ede0158350b1097c2530_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-es-rollover-rhel8@sha256:dee668b9269ffd46e3fb599f86161e5efa5e8a87cbad4586d30d5f9bf4d6882a_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-ingester-rhel8@sha256:8d006439b8629e2f3f790132aa2da22461ad373174252bf07293bad977010599_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-query-rhel8@sha256:73d2a132ec00dc7db60081fc428b259c08731ec78fc9b2aa70eb8513739955da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-19794"
},
{
"category": "external",
"summary": "RHBZ#1786761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1786761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-19794",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19794"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-19794",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19794"
}
],
"release_date": "2019-12-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-11-24T09:02:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://docs.openshift.com/container-platform/4.6/jaeger/jaeger_install/rhbjaeger-updating.html",
"product_ids": [
"8Base-JAEGER-1.20:distributed-tracing/jaeger-rhel8-operator@sha256:41a9209a1c04be67045966edfef822d464ca75b96ac488a1e8557980f0ca0a1c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:5198"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-JAEGER-1.20:distributed-tracing/jaeger-rhel8-operator@sha256:41a9209a1c04be67045966edfef822d464ca75b96ac488a1e8557980f0ca0a1c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "golang-github-miekg-dns: predictable TXID can lead to response forgeries"
},
{
"cve": "CVE-2020-14040",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-JAEGER-1.20:distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:368c464d25c0e7105fac06d868dbaf22aad0e5d0b131ede0158350b1097c2530_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-es-rollover-rhel8@sha256:dee668b9269ffd46e3fb599f86161e5efa5e8a87cbad4586d30d5f9bf4d6882a_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-rhel8-operator@sha256:41a9209a1c04be67045966edfef822d464ca75b96ac488a1e8557980f0ca0a1c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1853652"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific characters or strings to the vulnerable application, there is the potential to cause an infinite loop to occur using more memory, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "* OpenShift ServiceMesh (OSSM) 1.0 is Out Of Support Scope (OOSS) for Moderate and Low impact vulnerabilities. Jaeger was packaged with ServiceMesh in 1.0, and hence is also marked OOSS, but the Jaeger-Operator is a standalone product and is affected by this vulnerability.\n\n* Because Service Telemetry Framework does not directly use unicode.UTF16, no update will be provided at this time for STF\u0027s sg-core-container.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-JAEGER-1.20:distributed-tracing/jaeger-agent-rhel8@sha256:b865eafd2ca6f1973115f76d9dfcc95dc734115797208af0be6f08dcb9a5a9e3_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-all-in-one-rhel8@sha256:dab400d79fd6b6b0bc328003756eb4434bb07ded74973ca09d584a4623e7498b_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-collector-rhel8@sha256:08a9fb69f64617ef399f3baa9f649fd0b33ba4f65afa15d36630825b1417d083_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-ingester-rhel8@sha256:8d006439b8629e2f3f790132aa2da22461ad373174252bf07293bad977010599_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-query-rhel8@sha256:73d2a132ec00dc7db60081fc428b259c08731ec78fc9b2aa70eb8513739955da_amd64"
],
"known_not_affected": [
"8Base-JAEGER-1.20:distributed-tracing/jaeger-es-index-cleaner-rhel8@sha256:368c464d25c0e7105fac06d868dbaf22aad0e5d0b131ede0158350b1097c2530_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-es-rollover-rhel8@sha256:dee668b9269ffd46e3fb599f86161e5efa5e8a87cbad4586d30d5f9bf4d6882a_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-rhel8-operator@sha256:41a9209a1c04be67045966edfef822d464ca75b96ac488a1e8557980f0ca0a1c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14040"
},
{
"category": "external",
"summary": "RHBZ#1853652",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1853652"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14040",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14040"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14040",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14040"
},
{
"category": "external",
"summary": "https://github.com/golang/go/issues/39491",
"url": "https://github.com/golang/go/issues/39491"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0",
"url": "https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-11-24T09:02:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://docs.openshift.com/container-platform/4.6/jaeger/jaeger_install/rhbjaeger-updating.html",
"product_ids": [
"8Base-JAEGER-1.20:distributed-tracing/jaeger-agent-rhel8@sha256:b865eafd2ca6f1973115f76d9dfcc95dc734115797208af0be6f08dcb9a5a9e3_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-all-in-one-rhel8@sha256:dab400d79fd6b6b0bc328003756eb4434bb07ded74973ca09d584a4623e7498b_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-collector-rhel8@sha256:08a9fb69f64617ef399f3baa9f649fd0b33ba4f65afa15d36630825b1417d083_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-ingester-rhel8@sha256:8d006439b8629e2f3f790132aa2da22461ad373174252bf07293bad977010599_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-query-rhel8@sha256:73d2a132ec00dc7db60081fc428b259c08731ec78fc9b2aa70eb8513739955da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:5198"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-JAEGER-1.20:distributed-tracing/jaeger-agent-rhel8@sha256:b865eafd2ca6f1973115f76d9dfcc95dc734115797208af0be6f08dcb9a5a9e3_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-all-in-one-rhel8@sha256:dab400d79fd6b6b0bc328003756eb4434bb07ded74973ca09d584a4623e7498b_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-collector-rhel8@sha256:08a9fb69f64617ef399f3baa9f649fd0b33ba4f65afa15d36630825b1417d083_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-ingester-rhel8@sha256:8d006439b8629e2f3f790132aa2da22461ad373174252bf07293bad977010599_amd64",
"8Base-JAEGER-1.20:distributed-tracing/jaeger-query-rhel8@sha256:73d2a132ec00dc7db60081fc428b259c08731ec78fc9b2aa70eb8513739955da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash"
}
]
}
gsd-2019-19794
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2019-19794",
"description": "The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.",
"id": "GSD-2019-19794",
"references": [
"https://www.suse.com/security/cve/CVE-2019-19794.html",
"https://access.redhat.com/errata/RHSA-2020:5198",
"https://access.redhat.com/errata/RHSA-2022:2183"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2019-19794"
],
"details": "The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.",
"id": "GSD-2019-19794",
"modified": "2023-12-13T01:23:54.062930Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-19794",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/miekg/dns/issues/1043",
"refsource": "MISC",
"url": "https://github.com/miekg/dns/issues/1043"
},
{
"name": "https://github.com/coredns/coredns/issues/3519",
"refsource": "MISC",
"url": "https://github.com/coredns/coredns/issues/3519"
},
{
"name": "https://github.com/miekg/dns/pull/1044",
"refsource": "MISC",
"url": "https://github.com/miekg/dns/pull/1044"
},
{
"name": "https://github.com/miekg/dns/compare/v1.1.24...v1.1.25",
"refsource": "MISC",
"url": "https://github.com/miekg/dns/compare/v1.1.24...v1.1.25"
},
{
"name": "https://github.com/coredns/coredns/issues/3547",
"refsource": "CONFIRM",
"url": "https://github.com/coredns/coredns/issues/3547"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c1.1.25",
"affected_versions": "All versions before 1.1.25",
"cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-338",
"CWE-937"
],
"date": "2021-05-18",
"description": "The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.",
"fixed_versions": [
"1.1.25"
],
"identifier": "CVE-2019-19794",
"identifiers": [
"GHSA-44r7-7p62-q3fr",
"CVE-2019-19794"
],
"not_impacted": "All versions starting from 1.1.25",
"package_slug": "go/github.com/miekg/dns",
"pubdate": "2021-05-18",
"solution": "Upgrade to version 1.1.25 or above.",
"title": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2019-19794",
"https://github.com/coredns/coredns/issues/3519",
"https://github.com/coredns/coredns/issues/3547",
"https://github.com/miekg/dns/issues/1043",
"https://github.com/miekg/dns/pull/1044",
"https://github.com/miekg/dns/commit/8ebf2e419df7857ac8919baa05248789a8ffbf33",
"https://github.com/miekg/dns/compare/v1.1.24...v1.1.25",
"https://github.com/advisories/GHSA-44r7-7p62-q3fr"
],
"uuid": "a74c738d-4e53-4dd7-a12e-fc48e9f64eea"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:miekg-dns_project:miekg-dns:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.1.25",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-19794"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-338"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/miekg/dns/issues/1043",
"refsource": "MISC",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/miekg/dns/issues/1043"
},
{
"name": "https://github.com/coredns/coredns/issues/3519",
"refsource": "MISC",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/coredns/coredns/issues/3519"
},
{
"name": "https://github.com/miekg/dns/compare/v1.1.24...v1.1.25",
"refsource": "MISC",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/miekg/dns/compare/v1.1.24...v1.1.25"
},
{
"name": "https://github.com/miekg/dns/pull/1044",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/miekg/dns/pull/1044"
},
{
"name": "https://github.com/coredns/coredns/issues/3547",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/coredns/coredns/issues/3547"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6
}
},
"lastModifiedDate": "2020-01-02T17:36Z",
"publishedDate": "2019-12-13T22:15Z"
}
}
}
ghsa-44r7-7p62-q3fr
Vulnerability from github
Published
2021-05-18 21:09
Modified
2023-08-29 22:33
Severity ?
Summary
miekg/dns insecurely generates random numbers
Details
The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/miekg/dns"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.25"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-19794"
],
"database_specific": {
"cwe_ids": [
"CWE-330",
"CWE-338"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-18T20:42:52Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.",
"id": "GHSA-44r7-7p62-q3fr",
"modified": "2023-08-29T22:33:25Z",
"published": "2021-05-18T21:09:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19794"
},
{
"type": "WEB",
"url": "https://github.com/coredns/coredns/issues/3519"
},
{
"type": "WEB",
"url": "https://github.com/coredns/coredns/issues/3547"
},
{
"type": "WEB",
"url": "https://github.com/miekg/dns/issues/1037"
},
{
"type": "WEB",
"url": "https://github.com/miekg/dns/issues/1043"
},
{
"type": "WEB",
"url": "https://github.com/miekg/dns/pull/1044"
},
{
"type": "WEB",
"url": "https://github.com/miekg/dns/commit/8ebf2e419df7857ac8919baa05248789a8ffbf33"
},
{
"type": "WEB",
"url": "https://github.com/miekg/dns/compare/v1.1.24...v1.1.25"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2020-0008"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "miekg/dns insecurely generates random numbers"
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.