Action not permitted
Modal body text goes here.
CVE-2020-7662
Vulnerability from cvelistv5
Source | URL | Tags |
---|---|---|
report@snyk.io | https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions | Exploit, Third Party Advisory |
report@snyk.io | https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237 | Patch, Third Party Advisory |
report@snyk.io | https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv | Exploit, Third Party Advisory |
report@snyk.io | https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623 | Exploit, Technical Description, Third Party Advisory |
Vendor | Product |
---|---|
n/a | websocket-extensions (npm) |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T09:33:20.006Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "websocket-extensions (npm)", "vendor": "n/a", "versions": [ { "status": "affected", "version": "All versions prior to 0.1.4" } ] } ], "datePublic": "2020-06-02T00:00:00", "descriptions": [ { "lang": "en", "value": "websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header." } ], "problemTypes": [ { "descriptions": [ { "description": "Regular Expression Denial of Service (ReDoS)", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2020-12-18T21:10:46", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237" }, { "tags": [ "x_refsource_MISC" ], "url": "https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "report@snyk.io", "ID": "CVE-2020-7662", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "websocket-extensions (npm)", "version": { "version_data": [ { "version_value": "All versions prior to 0.1.4" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Regular Expression Denial of Service (ReDoS)" } ] } ] }, "references": { "reference_data": [ { "name": "https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions", "refsource": "MISC", "url": "https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions" }, { "name": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv", "refsource": "MISC", "url": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv" }, { "name": "https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237", "refsource": "MISC", "url": "https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237" }, { "name": "https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623" } ] } } } }, "cveMetadata": { "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2020-7662", "datePublished": "2020-06-02T18:28:46", "dateReserved": "2020-01-21T00:00:00", "dateUpdated": "2024-08-04T09:33:20.006Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2020-7662\",\"sourceIdentifier\":\"report@snyk.io\",\"published\":\"2020-06-02T19:15:12.403\",\"lastModified\":\"2020-12-23T18:22:38.827\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.\"},{\"lang\":\"es\",\"value\":\"El m\u00f3dulo de npm websocket-extensions versiones anteriores a 0.1.4 permite una denegaci\u00f3n de servicio (DoS) por medio de Regex Backtracking. El analizador de extensiones puede tardar un tiempo cuadr\u00e1tico cuando analiza un encabezado que contiene un valor de par\u00e1metro de cadena no cerrado cuyo contenido es una secuencia repetitiva de dos bytes de una barra diagonal inversa y alg\u00fan otro car\u00e1cter. Esto podr\u00eda ser abusado por un atacante para llevar a cabo una Denegaci\u00f3n de Servicio de Regex (ReDoS) en un servidor de un subproceso \u00fanico al proporcionar una carga \u00fatil maliciosa con el encabezado Sec-WebSocket-Extensions\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":5.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:websocket-extensions_project:websocket-extensions:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"0.1.4\",\"matchCriteriaId\":\"8DB781EF-866D-46E6-A817-2CB528145B37\"}]}]}],\"references\":[{\"url\":\"https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions\",\"source\":\"report@snyk.io\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237\",\"source\":\"report@snyk.io\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv\",\"source\":\"report@snyk.io\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623\",\"source\":\"report@snyk.io\",\"tags\":[\"Exploit\",\"Technical Description\",\"Third Party Advisory\"]}]}}" } }
rhsa-2020_4298
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 2023 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat OpenShift Container Platform 4.6.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic (CVE-2020-9283)\n\n* SSL/TLS: CBC padding timing attack (lucky-13) (CVE-2013-0169)\n\n* grafana: XSS vulnerability via a column style on the \"Dashboard \u003e Table Panel\" screen (CVE-2018-18624)\n\n* js-jquery: prototype pollution in object\u0027s prototype leading to denial of service or remote code execution or property injection (CVE-2019-11358)\n\n* npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions (CVE-2019-16769)\n\n* kibana: Prototype pollution in TSVB could result in arbitrary code execution (ESA-2020-06) (CVE-2020-7013)\n\n* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)\n\n* npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7662)\n\n* nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)\n\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* jQuery: passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n\n* grafana: stored XSS (CVE-2020-11110)\n\n* grafana: XSS annotation popup vulnerability (CVE-2020-12052)\n\n* grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)\n\n* nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures (CVE-2020-13822)\n\n* golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* openshift/console: text injection on error page via crafted url (CVE-2020-10715)\n\n* kibana: X-Frame-Option not set by default might lead to clickjacking (CVE-2020-10743)\n\n* openshift: restricted SCC allows pods to craft custom network packets (CVE-2020-14336)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4298", "url": "https://access.redhat.com/errata/RHSA-2020:4298" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2020/rhsa-2020_4298.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.6.1 image security update", "tracking": { "current_release_date": "2020-10-28T00:41:00Z", "generator": { "date": "2023-07-01T04:17:00Z", "engine": { "name": "Red Hat SDEngine", "version": "3.18.0" } }, "id": "RHSA-2020:4298", "initial_release_date": "2020-10-27T16:22:00Z", "revision_history": [ { "date": "2020-10-28T00:41:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.6", "product": { "name": "Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.6::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "category": "product_version", "name": "openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-ansible-operator:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "product": { "name": "openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "product_id": "openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0" } }, { "category": "product_version", "name": "openshift4/ose-cli:v4.6.0-202010080605.p0", "product": { "name": "openshift4/ose-cli:v4.6.0-202010080605.p0", "product_id": "openshift4/ose-cli:v4.6.0-202010080605.p0" } }, { "category": "product_version", "name": "openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "product": { "name": "openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "product_id": "openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "product": { "name": "openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "product_id": "openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "product": { "name": "openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "product_id": "openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "product": { "name": "openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "product_id": "openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "product": { "name": "openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "product_id": "openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0" } }, { "category": "product_version", "name": "openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-console-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-console-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-console-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-console:v4.6.0-202010100121.p0", "product": { "name": "openshift4/ose-console:v4.6.0-202010100121.p0", "product_id": "openshift4/ose-console:v4.6.0-202010100121.p0" } }, { "category": "product_version", "name": "openshift4/ose-coredns:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-coredns:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-coredns:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-descheduler:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-descheduler:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-descheduler:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "product": { "name": "openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "product_id": "openshift4/ose-docker-builder:v4.6.0-202010120952.p0" } }, { "category": "product_version", "name": "openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-docker-registry:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-etcd:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-etcd:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-etcd:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-grafana:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-grafana:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-grafana:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "product": { "name": "openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "product_id": "openshift4/ose-hyperkube:v4.6.0-202010081843.p0" } }, { "category": "product_version", "name": "openshift4/ose-installer:v4.6.0-202010081843.p0", "product": { "name": "openshift4/ose-installer:v4.6.0-202010081843.p0", "product_id": "openshift4/ose-installer:v4.6.0-202010081843.p0" } }, { "category": "product_version", "name": "openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "product": { "name": "openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "product_id": "openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0" } }, { "category": "product_version", "name": "openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-metering-presto:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-multus-cni:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "product": { "name": "openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "product_id": "openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0" } }, { "category": "product_version", "name": "openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "product": { "name": "openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "product_id": "openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0" } }, { "category": "product_version", "name": "openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "product": { "name": "openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "product_id": "openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0" } }, { "category": "product_version", "name": "openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "product": { "name": "openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "product_id": "openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0" } }, { "category": "product_version", "name": "openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "product": { "name": "openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "product_id": "openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0" } }, { "category": "product_version", "name": "openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-operator-registry:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-prometheus:v4.6.0-202009290409.p0", "product": { "name": "openshift4/ose-prometheus:v4.6.0-202009290409.p0", "product_id": "openshift4/ose-prometheus:v4.6.0-202009290409.p0" } }, { "category": "product_version", "name": "openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-ptp-operator:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-ptp:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-ptp:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-ptp:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "product": { "name": "openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "product_id": "openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0" } }, { "category": "product_version", "name": "openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "product": { "name": "openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "product_id": "openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0" } }, { "category": "product_version", "name": "openshift4/ose-tests:v4.6.0-202010120952.p0", "product": { "name": "openshift4/ose-tests:v4.6.0-202010120952.p0", "product_id": "openshift4/ose-tests:v4.6.0-202010120952.p0" } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-ansible-operator:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0" }, "product_reference": "openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cli:v4.6.0-202010080605.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0" }, "product_reference": "openshift4/ose-cli:v4.6.0-202010080605.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0" }, "product_reference": "openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0" }, "product_reference": "openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0" }, "product_reference": "openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0" }, "product_reference": "openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0" }, "product_reference": "openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-console-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-console-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-console:v4.6.0-202010100121.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0" }, "product_reference": "openshift4/ose-console:v4.6.0-202010100121.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-coredns:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-coredns:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-descheduler:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-descheduler:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-docker-builder:v4.6.0-202010120952.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0" }, "product_reference": "openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-docker-registry:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-etcd:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-etcd:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-grafana:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-grafana:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-hyperkube:v4.6.0-202010081843.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0" }, "product_reference": "openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-installer:v4.6.0-202010081843.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0" }, "product_reference": "openshift4/ose-installer:v4.6.0-202010081843.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0" }, "product_reference": "openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-multus-cni:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0" }, "product_reference": "openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0" }, "product_reference": "openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0" }, "product_reference": "openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0" }, "product_reference": "openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0" }, "product_reference": "openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-operator-registry:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-prometheus:v4.6.0-202009290409.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" }, "product_reference": "openshift4/ose-prometheus:v4.6.0-202009290409.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-ptp-operator:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-ptp:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-ptp:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0" }, "product_reference": "openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0" }, "product_reference": "openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-tests:v4.6.0-202010120952.p0 as a component of Red Hat OpenShift Container Platform 4.6", "product_id": "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" }, "product_reference": "openshift4/ose-tests:v4.6.0-202010120952.p0", "relates_to_product_reference": "8Base-RHOSE-4.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2013-0169", "discovery_date": "2013-02-04T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=907589" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the \"Lucky Thirteen\" issue.", "title": "Vulnerability description" }, { "category": "summary", "text": "CBC padding timing attack (lucky-13)", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0169", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0169" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0169", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0169" }, { "category": "external", "summary": "http://www.isg.rhul.ac.uk/tls/", "url": "http://www.isg.rhul.ac.uk/tls/" }, { "category": "external", "summary": "http://www.openssl.org/news/secadv_20130205.txt", "url": "http://www.openssl.org/news/secadv_20130205.txt" }, { "category": "external", "summary": "https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released", "url": "https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released" }, { "category": "external", "summary": "CVE-2013-0169", "url": "https://access.redhat.com/security/cve/CVE-2013-0169" }, { "category": "external", "summary": "bz#907589: CBC padding timing attack (lucky-13)", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907589" } ], "release_date": "2013-02-04T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "collateralDamagePotential": "NOT_DEFINED", "confidentialityImpact": "PARTIAL", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 0.0, "exploitability": "NOT_DEFINED", "integrityImpact": "PARTIAL", "integrityRequirement": "NOT_DEFINED", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "targetDistribution": "NOT_DEFINED", "temporalScore": 0.0, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0" ] } ], "threats": [ { "category": "impact", "date": "2013-02-04T00:00:00Z", "details": "Moderate" } ], "title": "CBC padding timing attack (lucky-13)" }, { "cve": "CVE-2018-18624", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-24T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1850572" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A flaw was found in grafana. An incomplete fix for CVE-2018-12099 allows for a XSS via a column style on the \"Dashboard \u003e Table Panel\" screen.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS vulnerability via a column style on the \"Dashboard \u003e Table Panel\" screen", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18624", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18624" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18624", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18624" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20200608-0008/", "url": "https://security.netapp.com/advisory/ntap-20200608-0008/" }, { "category": "external", "summary": "CVE-2018-18624", "url": "https://access.redhat.com/security/cve/CVE-2018-18624" }, { "category": "external", "summary": "bz#1850572: CVE-2018-18624 grafana: XSS vulnerability via a column style on the \"Dashboard \u003e Table Panel\" screen", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850572" } ], "release_date": "2020-06-02T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-06-24T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2018-18624 grafana: XSS vulnerability via a column style on the \"Dashboard \u003e Table Panel\" screen" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" }, { "category": "external", "summary": "CVE-2019-11358", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "bz#1701972: CVE-2019-11358 jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" } ], "release_date": "2019-03-27T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ] } ], "threats": [ { "category": "impact", "date": "2019-03-28T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2019-11358 jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2019-16769", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-17T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1848092" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A XSS flaw was found in npm-serialize-javascript. It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js\u0027s implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-16769", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16769" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-16769", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16769" }, { "category": "external", "summary": "CVE-2019-16769", "url": "https://access.redhat.com/security/cve/CVE-2019-16769" }, { "category": "external", "summary": "bz#1848092: CVE-2019-16769 npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848092" } ], "release_date": "2020-05-04T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-06-17T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2019-16769 npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions" }, { "cve": "CVE-2020-7013", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)" }, "discovery_date": "2020-06-19T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1849044" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.", "title": "Vulnerability description" }, { "category": "summary", "text": "kibana: Prototype pollution in TSVB could result in arbitrary code execution (ESA-2020-06)", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7013", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7013" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7013", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7013" }, { "category": "external", "summary": "https://discuss.elastic.co/t/elastic-stack-6-8-9-and-7-7-0-security-update/235571", "url": "https://discuss.elastic.co/t/elastic-stack-6-8-9-and-7-7-0-security-update/235571" }, { "category": "external", "summary": "CVE-2020-7013", "url": "https://access.redhat.com/security/cve/CVE-2020-7013" }, { "category": "external", "summary": "bz#1849044: CVE-2020-7013 kibana: Prototype pollution in TSVB could result in arbitrary code execution (ESA-2020-06)", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849044" } ], "release_date": "2020-06-03T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-06-19T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2020-7013 kibana: Prototype pollution in TSVB could result in arbitrary code execution (ESA-2020-06)" }, { "cve": "CVE-2020-7598", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-03-11T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1813344" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A flaw was found in nodejs-minimist, where it was tricked into adding or modifying properties of the Object.prototype using a \"constructor\" or \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7598", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7598" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7598", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7598" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764", "url": "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764" }, { "category": "external", "summary": "CVE-2020-7598", "url": "https://access.redhat.com/security/cve/CVE-2020-7598" }, { "category": "external", "summary": "bz#1813344: CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813344" } ], "release_date": "2020-03-10T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-03-11T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload" }, { "cve": "CVE-2020-7662", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-06-02T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1845982" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.", "title": "Vulnerability description" }, { "category": "summary", "text": "npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7662", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7662" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7662", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7662" }, { "category": "external", "summary": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv", "url": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv" }, { "category": "external", "summary": "CVE-2020-7662", "url": "https://access.redhat.com/security/cve/CVE-2020-7662" }, { "category": "external", "summary": "bz#1845982: CVE-2020-7662 npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845982" } ], "release_date": "2020-06-02T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-06-02T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2020-7662 npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser" }, { "cve": "CVE-2020-8203", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-07-15T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1857412" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-lodash: prototype pollution in zipObjectDeep function", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8203", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8203" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8203", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8203" }, { "category": "external", "summary": "https://hackerone.com/reports/712065", "url": "https://hackerone.com/reports/712065" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1523", "url": "https://www.npmjs.com/advisories/1523" }, { "category": "external", "summary": "CVE-2020-8203", "url": "https://access.redhat.com/security/cve/CVE-2020-8203" }, { "category": "external", "summary": "bz#1857412: CVE-2020-8203 nodejs-lodash: prototype pollution in zipObjectDeep function", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857412" } ], "release_date": "2020-04-27T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-07-15T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2020-8203 nodejs-lodash: prototype pollution in zipObjectDeep function" }, { "acknowledgments": [ { "names": [ "the Kubernetes Product Security Committee" ] }, { "names": [ "Wouter ter Maat" ], "organization": "Offensi", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-8559", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2020-06-26T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1851422" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A flaw was found in the Kubernetes API server, where it allows an attacker to escalate their privileges from a compromised node. This flaw allows an attacker who can intercept requests on a compromised node, to redirect those requests, along with their credentials, to perform actions on other endpoints that trust those credentials (including other clusters), allowing for escalation of privileges. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: compromised node could escalate to cluster level privileges", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8559", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8559" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8559", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8559" }, { "category": "external", "summary": "https://groups.google.com/g/kubernetes-security-announce/c/JAIGG5yNROs", "url": "https://groups.google.com/g/kubernetes-security-announce/c/JAIGG5yNROs" }, { "category": "external", "summary": "CVE-2020-8559", "url": "https://access.redhat.com/security/cve/CVE-2020-8559" }, { "category": "external", "summary": "bz#1851422: CVE-2020-8559 kubernetes: compromised node could escalate to cluster level privileges", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1851422" } ], "release_date": "2020-07-15T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-06-26T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2020-8559 kubernetes: compromised node could escalate to cluster level privileges" }, { "cve": "CVE-2020-9283", "cwe": { "id": "CWE-130", "name": "Improper Handling of Length Parameter Inconsistency" }, "discovery_date": "2020-02-19T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1804533" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A denial of service vulnerability was found in the SSH package of the golang.org/x/crypto library. An attacker could exploit this flaw by supplying crafted SSH ed25519 keys to cause a crash in applications that use this package as either an SSH client or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9283", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9283" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9283", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9283" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY", "url": "https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY" }, { "category": "external", "summary": "CVE-2020-9283", "url": "https://access.redhat.com/security/cve/CVE-2020-9283" }, { "category": "external", "summary": "bz#1804533: CVE-2020-9283 golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1804533" } ], "release_date": "2020-02-21T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-02-19T00:00:00Z", "details": "Important" } ], "title": "CVE-2020-9283 golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic" }, { "cve": "CVE-2020-10715", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-10-18T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1767665" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A content spoofing vulnerability was found in the openshift/console. This flaw allows an attacker to craft a URL and inject arbitrary text onto the error page that appears to be from the OpenShift instance. This attack could potentially convince a user that the inserted text is legitimate.", "title": "Vulnerability description" }, { "category": "summary", "text": "openshift/console: text injection on error page via crafted url", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10715", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10715" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10715", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10715" }, { "category": "external", "summary": "CVE-2020-10715", "url": "https://access.redhat.com/security/cve/CVE-2020-10715" }, { "category": "external", "summary": "bz#1767665: CVE-2020-10715 openshift/console: text injection on error page via crafted url", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1767665" } ], "release_date": "2020-07-27T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0" ] } ], "threats": [ { "category": "impact", "date": "2019-10-18T00:00:00Z", "details": "Low" } ], "title": "CVE-2020-10715 openshift/console: text injection on error page via crafted url" }, { "cve": "CVE-2020-10743", "cwe": { "id": "CWE-358", "name": "Improperly Implemented Security Check for Standard" }, "discovery_date": "2020-05-05T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1834550" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "It was discovered that OpenShift Container Platform\u0027s (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests. This flaw allows an attacker to trick a user into performing arbitrary actions in OCP\u0027s distribution of Kibana, such as clickjacking.", "title": "Vulnerability description" }, { "category": "summary", "text": "kibana: X-Frame-Option not set by default might lead to clickjacking", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10743", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10743" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10743", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10743" }, { "category": "external", "summary": "CVE-2020-10743", "url": "https://access.redhat.com/security/cve/CVE-2020-10743" }, { "category": "external", "summary": "bz#1834550: CVE-2020-10743 kibana: X-Frame-Option not set by default might lead to clickjacking", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1834550" } ], "release_date": "2020-01-27T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-05-05T00:00:00Z", "details": "Low" } ], "title": "CVE-2020-10743 kibana: X-Frame-Option not set by default might lead to clickjacking" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" }, { "category": "external", "summary": "CVE-2020-11022", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "bz#1828406: CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" } ], "release_date": "2020-04-23T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-04-23T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A flaw was found in jQuery. HTML containing \u003coption\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "category": "external", "summary": "CVE-2020-11023", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "bz#1850004: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" } ], "release_date": "2020-04-29T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-06-23T00:00:00Z", "details": "Moderate" } ], "title": "Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2020-11110", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-07-27T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1861044" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A flaw was found in grafana. The lack of URL sanitizing allows for stored XSS.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: stored XSS", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11110", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11110" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11110", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11110" }, { "category": "external", "summary": "CVE-2020-11110", "url": "https://access.redhat.com/security/cve/CVE-2020-11110" }, { "category": "external", "summary": "bz#1861044: CVE-2020-11110 grafana: stored XSS", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1861044" } ], "release_date": "2020-04-01T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-07-27T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2020-11110 grafana: stored XSS" }, { "cve": "CVE-2020-12052", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-17T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1848089" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A flaw was found in grafana. The software is vulnerable to an annotation popup XSS.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS annotation popup vulnerability", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-12052", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12052" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12052", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12052" }, { "category": "external", "summary": "CVE-2020-12052", "url": "https://access.redhat.com/security/cve/CVE-2020-12052" }, { "category": "external", "summary": "bz#1848089: CVE-2020-12052 grafana: XSS annotation popup vulnerability", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848089" } ], "release_date": "2020-04-27T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-06-17T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2020-12052 grafana: XSS annotation popup vulnerability" }, { "cve": "CVE-2020-12245", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-25T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1848643" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A flaw was found in grafana. A XSS is possible in table-panel via column.title or cellLinkTooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS via column.title or cellLinkTooltip", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-12245", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12245" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12245", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12245" }, { "category": "external", "summary": "CVE-2020-12245", "url": "https://access.redhat.com/security/cve/CVE-2020-12245" }, { "category": "external", "summary": "bz#1848643: CVE-2020-12245 grafana: XSS via column.title or cellLinkTooltip", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848643" } ], "release_date": "2020-04-23T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-04-25T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2020-12245 grafana: XSS via column.title or cellLinkTooltip" }, { "cve": "CVE-2020-13822", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2020-06-04T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1848647" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "The Elliptic for Node.js allows ECDSA signature malleability via variations in encoding, leading \u0027\\0\u0027 bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-13822", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13822" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13822", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13822" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-ELLIPTIC-571484", "url": "https://snyk.io/vuln/SNYK-JS-ELLIPTIC-571484" }, { "category": "external", "summary": "CVE-2020-13822", "url": "https://access.redhat.com/security/cve/CVE-2020-13822" }, { "category": "external", "summary": "bz#1848647: CVE-2020-13822 nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848647" } ], "release_date": "2020-06-01T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-06-04T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2020-13822 nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures" }, { "cve": "CVE-2020-14040", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)" }, "discovery_date": "2020-06-17T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1853652" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific characters or strings to the vulnerable application, there is the potential to cause an infinite loop to occur using more memory, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14040" }, { "category": "external", "summary": "https://github.com/golang/go/issues/39491", "url": "https://github.com/golang/go/issues/39491" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0", "url": "https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0" }, { "category": "external", "summary": "CVE-2020-14040", "url": "https://access.redhat.com/security/cve/CVE-2020-14040" }, { "category": "external", "summary": "bz#1853652: CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1853652" } ], "release_date": "2020-06-17T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-06-17T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash" }, { "acknowledgments": [ { "names": [ "Yuval Kashtan" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2020-14336", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2020-06-25T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1858981" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allows an attacker to cause a denial of service attack on an OpenShift Container Platform cluster if they can deploy pods. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "openshift: restricted SCC allows pods to craft custom network packets", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14336", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14336" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14336", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14336" }, { "category": "external", "summary": "CVE-2020-14336", "url": "https://access.redhat.com/security/cve/CVE-2020-14336" }, { "category": "external", "summary": "bz#1858981: CVE-2020-14336 openshift: restricted SCC allows pods to craft custom network packets", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1858981" } ], "release_date": "2020-07-13T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-06-25T00:00:00Z", "details": "Low" } ], "title": "CVE-2020-14336 openshift: restricted SCC allows pods to craft custom network packets" }, { "cve": "CVE-2020-15366", "cwe": { "id": "CWE-471", "name": "Modification of Assumed-Immutable Data (MAID)" }, "discovery_date": "2020-07-15T00:00:00Z", "flags": [ { "label": "component_not_present", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla", "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" } ], "notes": [ { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "description", "text": "A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ], "known_not_affected": [ "8Base-RHOSE-4.6:openshift4/ose-ansible-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-aws-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-azure-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-machine-controllers:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-baremetal-runtimecfg-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cli-artifacts:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cli:v4.6.0-202010080605.p0", "8Base-RHOSE-4.6:openshift4/ose-cloud-credential-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-authentication-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-autoscaler:v4.6.0-202009291152.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-capacity:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-config-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-dns-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-etcd-rhel8-operator:v4.6.0-202010062159.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-image-registry-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-apiserver-operator:v4.6.0-202010090300.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-controller-manager-operator:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-descheduler-rhel8-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-scheduler-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-machine-approver:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-apiserver-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-openshift-controller-manager-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-policy-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-samples-operator:v4.6.0-202009290409.p0", "8Base-RHOSE-4.6:openshift4/ose-cluster-storage-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-console-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-coredns:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-attacher:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-resizer:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-external-snapshotter:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-livenessprobe:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-node-driver-registrar:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-csi-snapshot-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-descheduler:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-builder:v4.6.0-202010120952.p0", "8Base-RHOSE-4.6:openshift4/ose-docker-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-elasticsearch-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-etcd:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-gcp-machine-controllers-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-grafana:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-hyperkube:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-installer:v4.6.0-202010081843.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-rbac-proxy:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-kube-storage-version-migrator-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-diskmaker:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-local-storage-static-provisioner:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-logging-kibana6:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-machine-config-operator:v4.6.0-202010220220.p0", "8Base-RHOSE-4.6:openshift4/ose-mdns-publisher-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-presto:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-metering-reporting-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-admission-controller:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-cni:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-route-override-cni-rhel8:v4.6.0-202010012244.p0", "8Base-RHOSE-4.6:openshift4/ose-multus-whereabouts-ipam-cni-rhel8:v4.6.0-202010011936.p0", "8Base-RHOSE-4.6:openshift4/ose-network-metrics-daemon-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-oauth-proxy:v4.6.0-202010010929.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-apiserver-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-openshift-controller-manager-rhel8:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-lifecycle-manager:v4.6.0-202010130555.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-marketplace:v4.6.0-202010081538.p0", "8Base-RHOSE-4.6:openshift4/ose-operator-registry:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp-operator:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-ptp:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-service-ca-operator:v4.6.0-202010061132.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-dp-admission-controller:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-config-daemon:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-device-plugin:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-sriov-network-webhook:v4.6.0-202010200139.p0", "8Base-RHOSE-4.6:openshift4/ose-tests:v4.6.0-202010120952.p0" ] }, "references": [ { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15366", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15366" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-AJV-584908", "url": "https://snyk.io/vuln/SNYK-JS-AJV-584908" }, { "category": "external", "summary": "CVE-2020-15366", "url": "https://access.redhat.com/security/cve/CVE-2020-15366" }, { "category": "external", "summary": "bz#1857977: CVE-2020-15366 nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977" } ], "release_date": "2020-07-04T00:00:00Z", "remediations": [ { "category": "vendor_fix", "details": "For OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.", "product_ids": [ "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ], "url": "https://access.redhat.com/errata/RHSA-2020:4298" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RHOSE-4.6:openshift4/ose-console:v4.6.0-202010100121.p0", "8Base-RHOSE-4.6:openshift4/ose-prometheus:v4.6.0-202009290409.p0" ] } ], "threats": [ { "category": "impact", "date": "2020-07-15T00:00:00Z", "details": "Moderate" } ], "title": "CVE-2020-15366 nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function" } ] }
rhsa-2020_2861
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for servicemesh-grafana is now available for OpenShift Service Mesh 1.0.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.\n\nSecurity Fix(es):\n\n* kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service (CVE-2019-11253)\n\n* grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL (CVE-2020-13379)\n\n* npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js (CVE-2020-7660)\n\n* npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7662)\n\n* grafana: XSS annotation popup vulnerability (CVE-2020-12052)\n\n* grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)\n\n* grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2861", "url": "https://access.redhat.com/errata/RHSA-2020:2861" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "1843640", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843640" }, { "category": "external", "summary": "1844228", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1844228" }, { "category": "external", "summary": "1845982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845982" }, { "category": "external", "summary": "1848089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848089" }, { "category": "external", "summary": "1848108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848108" }, { "category": "external", "summary": "1848643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848643" }, { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2020/rhsa-2020_2861.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana security update", "tracking": { "current_release_date": "2024-09-18T04:14:07+00:00", "generator": { "date": "2024-09-18T04:14:07+00:00", "engine": { "name": "Red Hat SDEngine", "version": "3.33.3" } }, "id": "RHSA-2020:2861", "initial_release_date": "2020-07-07T19:35:07+00:00", "revision_history": [ { "date": "2020-07-07T19:35:07+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-07T19:35:07+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-09-18T04:14:07+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift Service Mesh 1.0", "product": { "name": "OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:1.0::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Service Mesh" }, { "branches": [ { "category": "product_version", "name": "servicemesh-grafana-0:6.2.2-38.el8.x86_64", "product": { "name": "servicemesh-grafana-0:6.2.2-38.el8.x86_64", "product_id": "servicemesh-grafana-0:6.2.2-38.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana@6.2.2-38.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64", "product": { "name": "servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64", "product_id": "servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana-prometheus@6.2.2-38.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "servicemesh-grafana-0:6.2.2-38.el8.src", "product": { "name": "servicemesh-grafana-0:6.2.2-38.el8.src", "product_id": "servicemesh-grafana-0:6.2.2-38.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana@6.2.2-38.el8?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-0:6.2.2-38.el8.src as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src" }, "product_reference": "servicemesh-grafana-0:6.2.2-38.el8.src", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-0:6.2.2-38.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64" }, "product_reference": "servicemesh-grafana-0:6.2.2-38.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" }, "product_reference": "servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" }, { "cve": "CVE-2020-7660", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1844228" } ], "notes": [ { "category": "description", "text": "A flaw was found in the serialize-javascript before version 3.1.0. This flaw allows remote attackers to inject arbitrary code via the function \"deleteFunctions\" within \"index.js.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay includes serialize-javascript as a dependency of webpack which is only used at build time. The vulnerable library is not used at runtime meaning this has a low impact on Red Hat Quay.\n\nThe currently supported versions of Container Native Virtualization 2 are not affected by this flaw. However, version 2.0, which is no longer supported, is affected.\n\nIn OpenShift distributed tracing there is bundled vulnerable version of the serialize-javascript Nodejs package, however access to the vulnerable function is restricted and protected by OpenShift OAuth, hence the impact by this vulnerability is reduced to Low.\n\nIn Red Hat OpenShift Logging the openshift-logging/kibana6-rhel8 container bundles many nodejs packages as a build time dependencies, including the serialize-javascript package. \nThe vulnerable code is not used hence the impact to OpenShift Logging by this vulnerability is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7660" }, { "category": "external", "summary": "RHBZ#1844228", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1844228" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7660", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7660" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7660", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7660" } ], "release_date": "2020-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js" }, { "cve": "CVE-2020-7662", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-06-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1845982" } ], "notes": [ { "category": "description", "text": "websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.", "title": "Vulnerability description" }, { "category": "summary", "text": "npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable websocket-extension to authenticated users only, therefore the impact is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7662" }, { "category": "external", "summary": "RHBZ#1845982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845982" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7662", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7662" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7662", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7662" }, { "category": "external", "summary": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv", "url": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv" } ], "release_date": "2020-06-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser" }, { "cve": "CVE-2020-12052", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848089" } ], "notes": [ { "category": "description", "text": "A flaw was found in grafana. The software is vulnerable to an annotation popup XSS.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS annotation popup vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the version of the grafana package as shipped with Red Hat Ceph Storage (RHCS) version 2. Ceph-2 has reached End of Extended Life Cycle Support and no longer fixing moderates/lows.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-12052" }, { "category": "external", "summary": "RHBZ#1848089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848089" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-12052", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12052" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12052", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12052" } ], "release_date": "2020-04-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: XSS annotation popup vulnerability" }, { "cve": "CVE-2020-12245", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848643" } ], "notes": [ { "category": "description", "text": "A flaw was found in grafana. A XSS is possible in table-panel via column.title or cellLinkTooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS via column.title or cellLinkTooltip", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-12245" }, { "category": "external", "summary": "RHBZ#1848643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848643" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-12245", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12245" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12245", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12245" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: XSS via column.title or cellLinkTooltip" }, { "cve": "CVE-2020-13379", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "discovery_date": "2020-06-03T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1843640" } ], "notes": [ { "category": "description", "text": "An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the same issue can create a NULL pointer dereference vulnerability. This flaw allows an attacker to gain information about the network that Grafana is running on, or cause a segmentation fault, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the Grafana containers are behind OpenShift OAuth restricting access to the vulnerable path to authenticated users only. However, other pods may still access the vulnerable URL within the cluster. Therefore the impact is moderate for both (OCP and OSSM).\n\nRed Hat Ceph Storage 2 is now in Extended Life Support (ELS) Phase of the support. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Ceph Storage Life Cycle: https://access.redhat.com/support/policy/updates/ceph-storage", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-13379" }, { "category": "external", "summary": "RHBZ#1843640", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843640" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-13379", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13379" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13379", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13379" }, { "category": "external", "summary": "https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/", "url": "https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2020/06/09/2/", "url": "https://www.openwall.com/lists/oss-security/2020/06/09/2/" } ], "release_date": "2020-06-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" }, { "category": "workaround", "details": "This issue can be mitigated by blocking access to the URL path /avatar/*, through a method such as a reverse proxy, load balancer, application firewall etc.", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL" }, { "cve": "CVE-2020-13430", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848108" } ], "notes": [ { "category": "description", "text": "A flaw was found in grafana Tag value XSS via the OpenTSDB datasource are possible. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS via the OpenTSDB datasource", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Ceph Storage (RHCS) delivers the affected code of the grafana OpenTSDB plugin. However Red Hat Ceph Storage uses the Prometheus time-series database as a default data source not the OpenTSDB, hence the impact by this vulnerability is set to low.\n\nRed Hat Gluster Storage (RHGS) delivers the affected code of the grafana OpenTSDB plugin. However Red Hat Gluster Storage uses the Graphite as a data source not the OpenTSDB, hence the impact by this vulnerability is set to low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-13430" }, { "category": "external", "summary": "RHBZ#1848108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848108" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-13430", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13430" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13430", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13430" } ], "release_date": "2020-05-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2861" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-38.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-38.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: XSS via the OpenTSDB datasource" } ] }
rhsa-2020_2796
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for servicemesh-grafana is now available for OpenShift Service Mesh 1.1.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.\n\nSecurity Fix(es):\n\n* kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service (CVE-2019-11253)\n\n* grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL (CVE-2020-13379)\n\n* npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions (CVE-2019-16769)\n\n* npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js (CVE-2020-7660)\n\n* npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7662)\n\n* grafana: XSS annotation popup vulnerability (CVE-2020-12052)\n\n* grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)\n\n* grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2796", "url": "https://access.redhat.com/errata/RHSA-2020:2796" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "1843640", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843640" }, { "category": "external", "summary": "1844228", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1844228" }, { "category": "external", "summary": "1845982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845982" }, { "category": "external", "summary": "1848089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848089" }, { "category": "external", "summary": "1848092", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848092" }, { "category": "external", "summary": "1848108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848108" }, { "category": "external", "summary": "1848643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848643" }, { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2020/rhsa-2020_2796.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update", "tracking": { "current_release_date": "2024-09-18T04:13:23+00:00", "generator": { "date": "2024-09-18T04:13:23+00:00", "engine": { "name": "Red Hat SDEngine", "version": "3.33.3" } }, "id": "RHSA-2020:2796", "initial_release_date": "2020-07-01T18:46:37+00:00", "revision_history": [ { "date": "2020-07-01T18:46:37+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-01T18:46:37+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-09-18T04:13:23+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift Service Mesh 1.1", "product": { "name": "OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:1.1::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Service Mesh" }, { "branches": [ { "category": "product_version", "name": "servicemesh-grafana-0:6.4.3-11.el8.x86_64", "product": { "name": "servicemesh-grafana-0:6.4.3-11.el8.x86_64", "product_id": "servicemesh-grafana-0:6.4.3-11.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana@6.4.3-11.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64", "product": { "name": "servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64", "product_id": "servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana-prometheus@6.4.3-11.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "servicemesh-grafana-0:6.4.3-11.el8.src", "product": { "name": "servicemesh-grafana-0:6.4.3-11.el8.src", "product_id": "servicemesh-grafana-0:6.4.3-11.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana@6.4.3-11.el8?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-0:6.4.3-11.el8.src as a component of OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src" }, "product_reference": "servicemesh-grafana-0:6.4.3-11.el8.src", "relates_to_product_reference": "8Base-OSSM-1.1" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-0:6.4.3-11.el8.x86_64 as a component of OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64" }, "product_reference": "servicemesh-grafana-0:6.4.3-11.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.1" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64 as a component of OpenShift Service Mesh 1.1", "product_id": "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" }, "product_reference": "servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.1" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11253", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-10-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1757701" } ], "notes": [ { "category": "description", "text": "A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a \"billion laughs\" attack. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "For Red Hat OpenStack Platform, because kubernetes is not directly used in director-operator, the RHOSP Impact has been moved to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11253" }, { "category": "external", "summary": "RHBZ#1757701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757701" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11253", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253" }, { "category": "external", "summary": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/", "url": "https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/" } ], "release_date": "2019-09-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kubernetes: YAML parsing vulnerable to \"Billion Laughs\" attack, allowing for remote denial of service" }, { "cve": "CVE-2019-16769", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848092" } ], "notes": [ { "category": "description", "text": "A XSS flaw was found in npm-serialize-javascript. It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js\u0027s implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable serialize-javascript library to authenticated users only, therefore the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-16769" }, { "category": "external", "summary": "RHBZ#1848092", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848092" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-16769", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16769" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-16769", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16769" } ], "release_date": "2020-05-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions" }, { "cve": "CVE-2020-7660", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1844228" } ], "notes": [ { "category": "description", "text": "A flaw was found in the serialize-javascript before version 3.1.0. This flaw allows remote attackers to inject arbitrary code via the function \"deleteFunctions\" within \"index.js.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay includes serialize-javascript as a dependency of webpack which is only used at build time. The vulnerable library is not used at runtime meaning this has a low impact on Red Hat Quay.\n\nThe currently supported versions of Container Native Virtualization 2 are not affected by this flaw. However, version 2.0, which is no longer supported, is affected.\n\nIn OpenShift distributed tracing there is bundled vulnerable version of the serialize-javascript Nodejs package, however access to the vulnerable function is restricted and protected by OpenShift OAuth, hence the impact by this vulnerability is reduced to Low.\n\nIn Red Hat OpenShift Logging the openshift-logging/kibana6-rhel8 container bundles many nodejs packages as a build time dependencies, including the serialize-javascript package. \nThe vulnerable code is not used hence the impact to OpenShift Logging by this vulnerability is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7660" }, { "category": "external", "summary": "RHBZ#1844228", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1844228" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7660", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7660" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7660", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7660" } ], "release_date": "2020-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js" }, { "cve": "CVE-2020-7662", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-06-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1845982" } ], "notes": [ { "category": "description", "text": "websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.", "title": "Vulnerability description" }, { "category": "summary", "text": "npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable websocket-extension to authenticated users only, therefore the impact is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7662" }, { "category": "external", "summary": "RHBZ#1845982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845982" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7662", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7662" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7662", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7662" }, { "category": "external", "summary": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv", "url": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv" } ], "release_date": "2020-06-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser" }, { "cve": "CVE-2020-12052", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848089" } ], "notes": [ { "category": "description", "text": "A flaw was found in grafana. The software is vulnerable to an annotation popup XSS.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS annotation popup vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the version of the grafana package as shipped with Red Hat Ceph Storage (RHCS) version 2. Ceph-2 has reached End of Extended Life Cycle Support and no longer fixing moderates/lows.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-12052" }, { "category": "external", "summary": "RHBZ#1848089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848089" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-12052", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12052" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12052", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12052" } ], "release_date": "2020-04-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: XSS annotation popup vulnerability" }, { "cve": "CVE-2020-12245", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848643" } ], "notes": [ { "category": "description", "text": "A flaw was found in grafana. A XSS is possible in table-panel via column.title or cellLinkTooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS via column.title or cellLinkTooltip", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-12245" }, { "category": "external", "summary": "RHBZ#1848643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848643" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-12245", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12245" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12245", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12245" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: XSS via column.title or cellLinkTooltip" }, { "cve": "CVE-2020-13379", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "discovery_date": "2020-06-03T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1843640" } ], "notes": [ { "category": "description", "text": "An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the same issue can create a NULL pointer dereference vulnerability. This flaw allows an attacker to gain information about the network that Grafana is running on, or cause a segmentation fault, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL", "title": "Vulnerability summary" }, { "category": "other", "text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the Grafana containers are behind OpenShift OAuth restricting access to the vulnerable path to authenticated users only. However, other pods may still access the vulnerable URL within the cluster. Therefore the impact is moderate for both (OCP and OSSM).\n\nRed Hat Ceph Storage 2 is now in Extended Life Support (ELS) Phase of the support. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Ceph Storage Life Cycle: https://access.redhat.com/support/policy/updates/ceph-storage", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-13379" }, { "category": "external", "summary": "RHBZ#1843640", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843640" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-13379", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13379" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13379", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13379" }, { "category": "external", "summary": "https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/", "url": "https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2020/06/09/2/", "url": "https://www.openwall.com/lists/oss-security/2020/06/09/2/" } ], "release_date": "2020-06-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" }, { "category": "workaround", "details": "This issue can be mitigated by blocking access to the URL path /avatar/*, through a method such as a reverse proxy, load balancer, application firewall etc.", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL" }, { "cve": "CVE-2020-13430", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1848108" } ], "notes": [ { "category": "description", "text": "A flaw was found in grafana Tag value XSS via the OpenTSDB datasource are possible. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: XSS via the OpenTSDB datasource", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Ceph Storage (RHCS) delivers the affected code of the grafana OpenTSDB plugin. However Red Hat Ceph Storage uses the Prometheus time-series database as a default data source not the OpenTSDB, hence the impact by this vulnerability is set to low.\n\nRed Hat Gluster Storage (RHGS) delivers the affected code of the grafana OpenTSDB plugin. However Red Hat Gluster Storage uses the Graphite as a data source not the OpenTSDB, hence the impact by this vulnerability is set to low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-13430" }, { "category": "external", "summary": "RHBZ#1848108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848108" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-13430", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13430" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13430", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13430" } ], "release_date": "2020-05-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "The OpenShift Service Mesh release notes provide information on the features and\nknown issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html", "product_ids": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2796" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.src", "8Base-OSSM-1.1:servicemesh-grafana-0:6.4.3-11.el8.x86_64", "8Base-OSSM-1.1:servicemesh-grafana-prometheus-0:6.4.3-11.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: XSS via the OpenTSDB datasource" } ] }
gsd-2020-7662
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2020-7662", "description": "websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.", "id": "GSD-2020-7662", "references": [ "https://access.redhat.com/errata/RHSA-2020:4298", "https://access.redhat.com/errata/RHSA-2020:2861", "https://access.redhat.com/errata/RHSA-2020:2796" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2020-7662" ], "details": "websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.", "id": "GSD-2020-7662", "modified": "2023-12-13T01:21:51.385011Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "report@snyk.io", "ID": "CVE-2020-7662", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "websocket-extensions (npm)", "version": { "version_data": [ { "version_value": "All versions prior to 0.1.4" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Regular Expression Denial of Service (ReDoS)" } ] } ] }, "references": { "reference_data": [ { "name": "https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions", "refsource": "MISC", "url": "https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions" }, { "name": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv", "refsource": "MISC", "url": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv" }, { "name": "https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237", "refsource": "MISC", "url": "https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237" }, { "name": "https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "\u003c0.1.4", "affected_versions": "All versions before 0.1.4", "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cwe_ids": [ "CWE-1035", "CWE-937" ], "date": "2020-12-23", "description": "websocket-extensions npm module allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the `Sec-WebSocket-Extensions` header.", "fixed_versions": [ "0.1.4" ], "identifier": "CVE-2020-7662", "identifiers": [ "CVE-2020-7662", "GHSA-g78m-2chm-r7qv" ], "not_impacted": "All versions starting from 0.1.4", "package_slug": "npm/websocket-extensions", "pubdate": "2020-06-02", "solution": "Upgrade to version 0.1.4 or above.", "title": "Uncontrolled Resource Consumption", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2020-7662" ], "uuid": "38aa745f-c8a3-48c0-b24b-27cb4d48e1de" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:websocket-extensions_project:websocket-extensions:*:*:*:*:*:node.js:*:*", "cpe_name": [], "versionEndExcluding": "0.1.4", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "report@snyk.io", "ID": "CVE-2020-7662" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "NVD-CWE-Other" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237" }, { "name": "https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions", "refsource": "MISC", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions" }, { "name": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv", "refsource": "MISC", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv" }, { "name": "https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623", "refsource": "MISC", "tags": [ "Exploit", "Technical Description", "Third Party Advisory" ], "url": "https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } }, "lastModifiedDate": "2020-12-23T18:22Z", "publishedDate": "2020-06-02T19:15Z" } } }
ghsa-g78m-2chm-r7qv
Vulnerability from github
Impact
The ReDoS flaw allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request containing a header of the following form:
Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...
That is, a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. The parser takes exponential time to reject this header as invalid, and this will block the processing of any other work on the same thread. Thus if you are running a single-threaded server, such a request can render your service completely unavailable.
Patches
Users should upgrade to version 0.1.4.
Workarounds
There are no known work-arounds other than disabling any public-facing WebSocket functionality you are operating.
References
- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/
{ "affected": [ { "package": { "ecosystem": "npm", "name": "websocket-extensions" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.1.4" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2020-7662" ], "database_specific": { "cwe_ids": [ "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2020-06-03T23:10:26Z", "nvd_published_at": null, "severity": "HIGH" }, "details": "### Impact\n\nThe ReDoS flaw allows an attacker to exhaust the server\u0027s capacity to process\nincoming requests by sending a WebSocket handshake request containing a header\nof the following form:\n\n Sec-WebSocket-Extensions: a; b=\"\\c\\c\\c\\c\\c\\c\\c\\c\\c\\c ...\n\nThat is, a header containing an unclosed string parameter value whose content is\na repeating two-byte sequence of a backslash and some other character. The\nparser takes exponential time to reject this header as invalid, and this will\nblock the processing of any other work on the same thread. Thus if you are\nrunning a single-threaded server, such a request can render your service\ncompletely unavailable.\n\n### Patches\n\nUsers should upgrade to version 0.1.4.\n\n### Workarounds\n\nThere are no known work-arounds other than disabling any public-facing\nWebSocket functionality you are operating.\n\n### References\n\n- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/", "id": "GHSA-g78m-2chm-r7qv", "modified": "2021-08-25T21:51:05Z", "published": "2020-06-05T16:16:12Z", "references": [ { "type": "WEB", "url": "https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7662" }, { "type": "WEB", "url": "https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237" }, { "type": "WEB", "url": "https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions" }, { "type": "PACKAGE", "url": "https://github.com/faye/websocket-extensions-node" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "type": "CVSS_V3" } ], "summary": "Regular Expression Denial of Service in websocket-extensions (NPM package)" }
wid-sec-w-2023-1350
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Splunk Enterprise erm\u00f6glicht Monitoring und Analyse von Clickstream-Daten und Kundentransaktionen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise in diversen Komponenten von Drittanbietern ausnutzen, um einen nicht n\u00e4her spezifizierten Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1350 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1350.json" }, { "category": "self", "summary": "WID-SEC-2023-1350 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1350" }, { "category": "external", "summary": "Splunk Enterprise Security Advisory SVD-2023-0613 vom 2023-06-01", "url": "https://advisory.splunk.com/advisories/SVD-2023-0613" }, { "category": "external", "summary": "IBM Security Bulletin 7008449 vom 2023-06-29", "url": "https://www.ibm.com/support/pages/node/7008449" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:0196-1 vom 2024-01-23", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-January/017743.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:0487-1 vom 2024-02-15", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-February/017931.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:0486-1 vom 2024-02-15", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-February/017932.html" } ], "source_lang": "en-US", "title": "Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern", "tracking": { "current_release_date": "2024-02-15T23:00:00.000+00:00", "generator": { "date": "2024-02-16T09:06:57.360+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-1350", "initial_release_date": "2023-06-01T22:00:00.000+00:00", "revision_history": [ { "date": "2023-06-01T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-06-29T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-01-23T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-02-15T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von SUSE aufgenommen" } ], "status": "final", "version": "4" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "IBM DB2", "product": { "name": "IBM DB2", "product_id": "5104", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:-" } } } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c 8.1.14", "product": { "name": "Splunk Splunk Enterprise \u003c 8.1.14", "product_id": "T027935", "product_identification_helper": { "cpe": "cpe:/a:splunk:splunk:8.1.14" } } }, { "category": "product_version_range", "name": "\u003c 8.2.11", "product": { "name": "Splunk Splunk Enterprise \u003c 8.2.11", "product_id": "T027936", "product_identification_helper": { "cpe": "cpe:/a:splunk:splunk:8.2.11" } } }, { "category": "product_version_range", "name": "\u003c 9.0.5", "product": { "name": "Splunk Splunk Enterprise \u003c 9.0.5", "product_id": "T027937", "product_identification_helper": { "cpe": "cpe:/a:splunk:splunk:9.0.5" } } } ], "category": "product_name", "name": "Splunk Enterprise" } ], "category": "vendor", "name": "Splunk" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-27538", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2023-27538" }, { "cve": "CVE-2023-27537", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2023-27537" }, { "cve": "CVE-2023-27536", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2023-27536" }, { "cve": "CVE-2023-27535", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2023-27535" }, { "cve": "CVE-2023-27534", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2023-27534" }, { "cve": "CVE-2023-27533", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2023-27533" }, { "cve": "CVE-2023-23916", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2023-23916" }, { "cve": "CVE-2023-23915", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2023-23915" }, { "cve": "CVE-2023-23914", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2023-23914" }, { "cve": "CVE-2023-1370", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2023-1370" }, { "cve": "CVE-2023-0286", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2023-0286" }, { "cve": "CVE-2023-0215", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2023-0215" }, { "cve": "CVE-2022-46175", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-46175" }, { "cve": "CVE-2022-43680", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-43680" }, { "cve": "CVE-2022-43552", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-43552" }, { "cve": "CVE-2022-43551", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-43551" }, { "cve": "CVE-2022-4304", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-4304" }, { "cve": "CVE-2022-42916", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-42916" }, { "cve": "CVE-2022-42915", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-42915" }, { "cve": "CVE-2022-42004", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-42004" }, { "cve": "CVE-2022-4200", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-4200" }, { "cve": "CVE-2022-41720", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-41720" }, { "cve": "CVE-2022-41716", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-41716" }, { "cve": "CVE-2022-41715", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-41715" }, { "cve": "CVE-2022-40304", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-40304" }, { "cve": "CVE-2022-40303", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-40303" }, { "cve": "CVE-2022-40023", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-40023" }, { "cve": "CVE-2022-38900", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-38900" }, { "cve": "CVE-2022-37616", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-37616" }, { "cve": "CVE-2022-37603", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-37603" }, { "cve": "CVE-2022-37601", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-37601" }, { "cve": "CVE-2022-37599", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-37599" }, { "cve": "CVE-2022-37434", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-37434" }, { "cve": "CVE-2022-36227", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-36227" }, { "cve": "CVE-2022-35737", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-35737" }, { "cve": "CVE-2022-35260", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-35260" }, { "cve": "CVE-2022-35252", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-35252" }, { "cve": "CVE-2022-3517", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-3517" }, { "cve": "CVE-2022-33987", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-33987" }, { "cve": "CVE-2022-32221", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-32221" }, { "cve": "CVE-2022-32208", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-32208" }, { "cve": "CVE-2022-32207", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-32207" }, { "cve": "CVE-2022-32206", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-32206" }, { "cve": "CVE-2022-32205", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-32205" }, { "cve": "CVE-2022-32189", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-32189" }, { "cve": "CVE-2022-32148", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-32148" }, { "cve": "CVE-2022-31129", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-31129" }, { "cve": "CVE-2022-30635", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-30635" }, { "cve": "CVE-2022-30634", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-30634" }, { "cve": "CVE-2022-30633", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-30633" }, { "cve": "CVE-2022-30632", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-30632" }, { "cve": "CVE-2022-30631", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-30631" }, { "cve": "CVE-2022-30630", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-30630" }, { "cve": "CVE-2022-30629", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-30629" }, { "cve": "CVE-2022-30580", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-30580" }, { "cve": "CVE-2022-30115", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-30115" }, { "cve": "CVE-2022-29804", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-29804" }, { "cve": "CVE-2022-29526", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-29526" }, { "cve": "CVE-2022-2880", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-2880" }, { "cve": "CVE-2022-2879", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-2879" }, { "cve": "CVE-2022-28327", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-28327" }, { "cve": "CVE-2022-28131", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-28131" }, { "cve": "CVE-2022-27782", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-27782" }, { "cve": "CVE-2022-27781", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-27781" }, { "cve": "CVE-2022-27780", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-27780" }, { "cve": "CVE-2022-27779", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-27779" }, { "cve": "CVE-2022-27778", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-27778" }, { "cve": "CVE-2022-27776", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-27776" }, { "cve": "CVE-2022-27775", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-27775" }, { "cve": "CVE-2022-27774", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-27774" }, { "cve": "CVE-2022-27664", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-27664" }, { "cve": "CVE-2022-27191", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-27191" }, { "cve": "CVE-2022-25858", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-25858" }, { "cve": "CVE-2022-24999", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-24999" }, { "cve": "CVE-2022-24921", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-24921" }, { "cve": "CVE-2022-24675", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-24675" }, { "cve": "CVE-2022-23806", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-23806" }, { "cve": "CVE-2022-23773", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-23773" }, { "cve": "CVE-2022-23772", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-23772" }, { "cve": "CVE-2022-23491", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-23491" }, { "cve": "CVE-2022-22576", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-22576" }, { "cve": "CVE-2022-1962", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-1962" }, { "cve": "CVE-2022-1705", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2022-1705" }, { "cve": "CVE-2021-43565", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-43565" }, { "cve": "CVE-2021-3803", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-3803" }, { "cve": "CVE-2021-36976", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-36976" }, { "cve": "CVE-2021-3520", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-3520" }, { "cve": "CVE-2021-33587", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-33587" }, { "cve": "CVE-2021-33503", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-33503" }, { "cve": "CVE-2021-33502", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-33502" }, { "cve": "CVE-2021-31566", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-31566" }, { "cve": "CVE-2021-29060", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-29060" }, { "cve": "CVE-2021-27292", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-27292" }, { "cve": "CVE-2021-23382", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-23382" }, { "cve": "CVE-2021-23368", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-23368" }, { "cve": "CVE-2021-23343", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-23343" }, { "cve": "CVE-2021-22947", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22947" }, { "cve": "CVE-2021-22946", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22946" }, { "cve": "CVE-2021-22945", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22945" }, { "cve": "CVE-2021-22926", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22926" }, { "cve": "CVE-2021-22925", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22925" }, { "cve": "CVE-2021-22924", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22924" }, { "cve": "CVE-2021-22923", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22923" }, { "cve": "CVE-2021-22922", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22922" }, { "cve": "CVE-2021-22901", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22901" }, { "cve": "CVE-2021-22898", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22898" }, { "cve": "CVE-2021-22897", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22897" }, { "cve": "CVE-2021-22890", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22890" }, { "cve": "CVE-2021-22876", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-22876" }, { "cve": "CVE-2021-20095", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2021-20095" }, { "cve": "CVE-2020-8286", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-8286" }, { "cve": "CVE-2020-8285", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-8285" }, { "cve": "CVE-2020-8284", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-8284" }, { "cve": "CVE-2020-8231", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-8231" }, { "cve": "CVE-2020-8203", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-8203" }, { "cve": "CVE-2020-8177", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-8177" }, { "cve": "CVE-2020-8169", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-8169" }, { "cve": "CVE-2020-8116", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-8116" }, { "cve": "CVE-2020-7774", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-7774" }, { "cve": "CVE-2020-7753", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-7753" }, { "cve": "CVE-2020-7662", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-7662" }, { "cve": "CVE-2020-28469", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-28469" }, { "cve": "CVE-2020-15138", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-15138" }, { "cve": "CVE-2020-13822", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2020-13822" }, { "cve": "CVE-2019-20149", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2019-20149" }, { "cve": "CVE-2019-10746", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2019-10746" }, { "cve": "CVE-2019-10744", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2019-10744" }, { "cve": "CVE-2018-25032", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2018-25032" }, { "cve": "CVE-2017-16042", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Splunk Splunk Enterprise in zahlreichen Komponenten von Drittanbietern (OpenSSL, curl, go, zlib, SQLite, json und weitere), die zum aktuellen Zeitpunkt nicht im Detail beschrieben und ver\u00f6ffentlicht wurden. Ein Angreifer kann diese Schwachstellen ausnutzen, um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T002207", "5104" ] }, "release_date": "2023-06-01T22:00:00Z", "title": "CVE-2017-16042" } ] }