Action not permitted
Modal body text goes here.
CVE-2020-8555
Vulnerability from cvelistv5
Published
2020-06-04 21:50
Modified
2024-09-16 18:39
Severity ?
EPSS score ?
Summary
Kubernetes kube-controller-manager SSRF
References
▼ | URL | Tags | |
---|---|---|---|
jordan@liggitt.net | http://www.openwall.com/lists/oss-security/2020/06/01/4 | Mailing List, Third Party Advisory | |
jordan@liggitt.net | http://www.openwall.com/lists/oss-security/2021/05/04/8 | Mailing List, Third Party Advisory | |
jordan@liggitt.net | https://github.com/kubernetes/kubernetes/issues/91542 | Third Party Advisory | |
jordan@liggitt.net | https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion | Mailing List, Third Party Advisory | |
jordan@liggitt.net | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/ | ||
jordan@liggitt.net | https://security.netapp.com/advisory/ntap-20200724-0005/ | Third Party Advisory |
Impacted products
▼ | Vendor | Product |
---|---|---|
Kubernetes | Kubernetes |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T10:03:46.110Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "[oss-security] 20200601 CVE-2020-8555: Kubernetes: Half-Blind SSRF in kube-controller-manager", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2020/06/01/4" }, { "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/kubernetes/kubernetes/issues/91542" }, { "name": "FEDORA-2020-aeea04cd13", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20200724-0005/" }, { "name": "[oss-security] 20210504 [kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2021/05/04/8" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Kubernetes", "vendor": "Kubernetes", "versions": [ { "status": "affected", "version": "1.18.0" }, { "status": "affected", "version": "1.1" }, { "status": "affected", "version": "1.2" }, { "status": "affected", "version": "1.3" }, { "status": "affected", "version": "1.4" }, { "status": "affected", "version": "1.5" }, { "status": "affected", "version": "1.6" }, { "status": "affected", "version": "1.7" }, { "status": "affected", "version": "1.8" }, { "status": "affected", "version": "1.9" }, { "status": "affected", "version": "1.10" }, { "status": "affected", "version": "1.11" }, { "status": "affected", "version": "1.12" }, { "status": "affected", "version": "1.13" }, { "status": "affected", "version": "1.14" }, { "lessThan": "1.15.12", "status": "affected", "version": "1.15", "versionType": "custom" }, { "lessThan": "1.16.9", "status": "affected", "version": "1.16", "versionType": "custom" }, { "lessThan": "1.17.5", "status": "affected", "version": "1.17", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Brice Augras from Groupe-Asten and Christophe Hauquiert from Nokia" } ], "descriptions": [ { "lang": "en", "value": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services)." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2021-05-04T20:06:18", "orgId": "a6081bf6-c852-4425-ad4f-a67919267565", "shortName": "kubernetes" }, "references": [ { "name": "[oss-security] 20200601 CVE-2020-8555: Kubernetes: Half-Blind SSRF in kube-controller-manager", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2020/06/01/4" }, { "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/kubernetes/kubernetes/issues/91542" }, { "name": "FEDORA-2020-aeea04cd13", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://security.netapp.com/advisory/ntap-20200724-0005/" }, { "name": "[oss-security] 20210504 [kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2021/05/04/8" } ], "source": { "defect": [ "https://github.com/kubernetes/kubernetes/issues/91542" ], "discovery": "EXTERNAL" }, "title": "Kubernetes kube-controller-manager SSRF", "workarounds": [ { "lang": "en", "value": "Prior to upgrading, this vulnerability can be mitigated by adding endpoint protections on the master or restricting usage of the vulnerable volume types (for example by constraining usage with a PodSecurityPolicy or third-party admission controller such as Gatekeeper) and restricting StorageClass write permissions through RBAC." } ], "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "AKA": "", "ASSIGNER": "security@kubernetes.io", "DATE_PUBLIC": "", "ID": "CVE-2020-8555", "STATE": "PUBLIC", "TITLE": "Kubernetes kube-controller-manager SSRF" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Kubernetes", "version": { "version_data": [ { "platform": "", "version_affected": "\u003c", "version_name": "1.15", "version_value": "1.15.12" }, { "platform": "", "version_affected": "\u003c", "version_name": "1.16", "version_value": "1.16.9" }, { "platform": "", "version_affected": "\u003c", "version_name": "1.17", "version_value": "1.17.5" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.18.0" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.1" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.2" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.3" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.4" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.5" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.6" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.7" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.8" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.9" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.10" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.11" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.12" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.13" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.14" } ] } } ] }, "vendor_name": "Kubernetes" } ] } }, "configuration": [], "credit": [ { "lang": "eng", "value": "Brice Augras from Groupe-Asten and Christophe Hauquiert from Nokia" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services)." } ] }, "exploit": [], "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-918 Server-Side Request Forgery (SSRF)" } ] } ] }, "references": { "reference_data": [ { "name": "[oss-security] 20200601 CVE-2020-8555: Kubernetes: Half-Blind SSRF in kube-controller-manager", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2020/06/01/4" }, { "name": "", "refsource": "MLIST", "url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion" }, { "name": "https://github.com/kubernetes/kubernetes/issues/91542", "refsource": "CONFIRM", "url": "https://github.com/kubernetes/kubernetes/issues/91542" }, { "name": "FEDORA-2020-aeea04cd13", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/" }, { "name": "https://security.netapp.com/advisory/ntap-20200724-0005/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20200724-0005/" }, { "name": "[oss-security] 20210504 [kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2021/05/04/8" } ] }, "solution": [], "source": { "advisory": "", "defect": [ "https://github.com/kubernetes/kubernetes/issues/91542" ], "discovery": "EXTERNAL" }, "work_around": [ { "lang": "en", "value": "Prior to upgrading, this vulnerability can be mitigated by adding endpoint protections on the master or restricting usage of the vulnerable volume types (for example by constraining usage with a PodSecurityPolicy or third-party admission controller such as Gatekeeper) and restricting StorageClass write permissions through RBAC." } ] } } }, "cveMetadata": { "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565", "assignerShortName": "kubernetes", "cveId": "CVE-2020-8555", "datePublished": "2020-06-04T21:50:11.749943Z", "dateReserved": "2020-02-03T00:00:00", "dateUpdated": "2024-09-16T18:39:58.006Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2020-8555\",\"sourceIdentifier\":\"jordan@liggitt.net\",\"published\":\"2020-06-05T17:15:11.640\",\"lastModified\":\"2023-11-07T03:26:37.350\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).\"},{\"lang\":\"es\",\"value\":\"El Kubernetes kube-controller-manager en las versiones v1.0-1.14, versiones anteriores a v1.15.12, v1.16.9, v1.17.5 y v1.18.0, son vulnerables a un ataque de tipo Server Side Request Forgery (SSRF) que permite que determinados usuarios autorizados pierdan hasta 500 bytes de informaci\u00f3n arbitraria de endpoints desprotegidos dentro de la red host del maestro (tales como los servicios link-local o loopback)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.8,\"impactScore\":4.0},{\"source\":\"jordan@liggitt.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.8,\"impactScore\":4.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:P/I:N/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":3.5},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]},{\"source\":\"jordan@liggitt.net\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.15.11\",\"matchCriteriaId\":\"1BB84B14-8D71-4BEA-90FC-DB76F9A0F781\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.16.0\",\"versionEndExcluding\":\"1.16.9\",\"matchCriteriaId\":\"111CE2DC-82F8-4AF6-99B6-5BB847A18D95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.17.0\",\"versionEndExcluding\":\"1.17.5\",\"matchCriteriaId\":\"9D5D5658-D416-434A-BA64-74DA2A4F13E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:1.18.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF65B08E-28BD-496F-88AE-CB7271BD7379\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D96259-24BD-44E2-96D9-78CE1D41F956\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2020/06/01/4\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/05/04/8\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/kubernetes/kubernetes/issues/91542\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/\",\"source\":\"jordan@liggitt.net\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20200724-0005/\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
ghsa-x6mj-w4jf-jmgw
Vulnerability from github
Published
2022-02-15 01:57
Modified
2023-09-18 22:44
Severity ?
Summary
Server Side Request Forgery (SSRF) in Kubernetes
Details
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
{ "affected": [ { "package": { "ecosystem": "Go", "name": "k8s.io/kubernetes" }, "ranges": [ { "events": [ { "introduced": "1.18.0" }, { "fixed": "1.18.1" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Go", "name": "k8s.io/kubernetes" }, "ranges": [ { "events": [ { "introduced": "1.17.0" }, { "fixed": "1.17.4" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Go", "name": "k8s.io/kubernetes" }, "ranges": [ { "events": [ { "introduced": "1.16.0" }, { "fixed": "1.16.9" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Go", "name": "k8s.io/kubernetes" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1.15.12" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2020-8555" ], "database_specific": { "cwe_ids": [ "CWE-918" ], "github_reviewed": true, "github_reviewed_at": "2021-05-13T20:13:43Z", "nvd_published_at": "2020-06-05T17:15:00Z", "severity": "MODERATE" }, "details": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).", "id": "GHSA-x6mj-w4jf-jmgw", "modified": "2023-09-18T22:44:56Z", "published": "2022-02-15T01:57:18Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555" }, { "type": "WEB", "url": "https://github.com/kubernetes/kubernetes/issues/91542" }, { "type": "WEB", "url": "https://github.com/kubernetes/kubernetes/pull/89794" }, { "type": "WEB", "url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20200724-0005" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2020/06/01/4" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/05/04/8" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "type": "CVSS_V3" } ], "summary": "Server Side Request Forgery (SSRF) in Kubernetes" }
rhsa-2020_2441
Vulnerability from csaf_redhat
Published
2020-06-17 20:15
Modified
2024-11-05 22:18
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift-enterprise-hyperkube-container security update
Notes
Topic
An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.3.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: A server side request forgery (SSRF) in the kube-controller-manager allows certain authorized users to leak up to 500 bytes of arbitrary information from the master's host network (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.3.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: A server side request forgery (SSRF) in the kube-controller-manager allows certain authorized users to leak up to 500 bytes of arbitrary information from the master\u0027s host network (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2441", "url": "https://access.redhat.com/errata/RHSA-2020:2441" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1821583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2441.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift-enterprise-hyperkube-container security update", "tracking": { "current_release_date": "2024-11-05T22:18:53+00:00", "generator": { "date": "2024-11-05T22:18:53+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2020:2441", "initial_release_date": "2020-06-17T20:15:20+00:00", "revision_history": [ { "date": "2020-06-17T20:15:20+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-06-17T20:15:20+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T22:18:53+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.3", "product": { "name": "Red Hat OpenShift Container Platform 4.3", "product_id": "7Server-RH7-RHOSE-4.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.3::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64", "product": { "name": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64", "product_id": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64", "product_identification_helper": { "purl": "pkg:oci/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.3.25" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x", "product": { "name": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x", "product_id": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x", "product_identification_helper": { "purl": "pkg:oci/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1?arch=s390x\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.3.25" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le", "product": { "name": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le", "product_id": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le", "product_identification_helper": { "purl": "pkg:oci/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.3.25" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le as a component of Red Hat OpenShift Container Platform 4.3", "product_id": "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le" }, "product_reference": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x as a component of Red Hat OpenShift Container Platform 4.3", "product_id": "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x" }, "product_reference": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x", "relates_to_product_reference": "7Server-RH7-RHOSE-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64 as a component of Red Hat OpenShift Container Platform 4.3", "product_id": "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64" }, "product_reference": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.3" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Kubernetes Product Security Committee" ] }, { "names": [ "Brice Augras" ], "organization": "Groupe-Asten", "summary": "Acknowledged by upstream." }, { "names": [ "Christophe Hauquiert" ], "organization": "Nokia", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-8555", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2020-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1821583" } ], "notes": [ { "category": "description", "text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le", "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x", "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8555" }, { "category": "external", "summary": "RHBZ#1821583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8555" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30" } ], "release_date": "2020-06-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-06-17T20:15:20+00:00", "details": "For OpenShift Container Platform 4.3 see the following documentation, which\nwill be updated shortly for release 4.3.25, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le", "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x", "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2441" }, { "category": "workaround", "details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC", "product_ids": [ "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le", "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x", "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le", "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x", "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information" } ] }
rhsa-2020_2440
Vulnerability from csaf_redhat
Published
2020-06-17 19:44
Modified
2024-11-05 22:18
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift security update
Notes
Topic
An update for openshift is now available for Red Hat OpenShift Container Platform 4.3.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: A server side request forgery (SSRF) in the kube-controller-manager allows certain authorized users to leak up to 500 bytes of arbitrary information from the master's host network (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openshift is now available for Red Hat OpenShift Container Platform 4.3.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: A server side request forgery (SSRF) in the kube-controller-manager allows certain authorized users to leak up to 500 bytes of arbitrary information from the master\u0027s host network (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2440", "url": "https://access.redhat.com/errata/RHSA-2020:2440" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1821583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2440.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift security update", "tracking": { "current_release_date": "2024-11-05T22:18:46+00:00", "generator": { "date": "2024-11-05T22:18:46+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2020:2440", "initial_release_date": "2020-06-17T19:44:13+00:00", "revision_history": [ { "date": "2020-06-17T19:44:13+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-06-17T19:44:13+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T22:18:46+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.3", "product": { "name": "Red Hat OpenShift Container Platform 4.3", "product_id": "8Base-RHOSE-4.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.3::el8" } } }, { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.3", "product": { "name": "Red Hat OpenShift Container Platform 4.3", "product_id": "7Server-RH7-RHOSE-4.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.3::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src", "product": { "name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src", "product_id": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift@4.3.25-202006060952.git.1.96c30f6.el8?arch=src" } } }, { "category": "product_version", "name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src", "product": { "name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src", "product_id": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift@4.3.25-202006060952.git.1.96c30f6.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le", "product": { "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le", "product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le", "product": { "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le", "product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x", "product": { "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x", "product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el8?arch=s390x" } } }, { "category": "product_version", "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x", "product": { "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x", "product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el7?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64", "product": { "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64", "product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el8?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64", "product": { "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64", "product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src as a component of Red Hat OpenShift Container Platform 4.3", "product_id": "7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src" }, "product_reference": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le as a component of Red Hat OpenShift Container Platform 4.3", "product_id": "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le" }, "product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x as a component of Red Hat OpenShift Container Platform 4.3", "product_id": "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x" }, "product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x", "relates_to_product_reference": "7Server-RH7-RHOSE-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.3", "product_id": "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64" }, "product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src as a component of Red Hat OpenShift Container Platform 4.3", "product_id": "8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src" }, "product_reference": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.3", "product_id": "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le" }, "product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le", "relates_to_product_reference": "8Base-RHOSE-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x as a component of Red Hat OpenShift Container Platform 4.3", "product_id": "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x" }, "product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x", "relates_to_product_reference": "8Base-RHOSE-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.3", "product_id": "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64" }, "product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.3" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Kubernetes Product Security Committee" ] }, { "names": [ "Brice Augras" ], "organization": "Groupe-Asten", "summary": "Acknowledged by upstream." }, { "names": [ "Christophe Hauquiert" ], "organization": "Nokia", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-8555", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2020-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1821583" } ], "notes": [ { "category": "description", "text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src", "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le", "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x", "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64", "8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src", "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le", "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x", "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8555" }, { "category": "external", "summary": "RHBZ#1821583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8555" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30" } ], "release_date": "2020-06-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-06-17T19:44:13+00:00", "details": "For OpenShift Container Platform 4.3 see the following documentation, which\nwill be updated shortly for release 4.3.25, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src", "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le", "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x", "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64", "8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src", "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le", "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x", "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2440" }, { "category": "workaround", "details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC", "product_ids": [ "7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src", "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le", "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x", "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64", "8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src", "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le", "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x", "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src", "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le", "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x", "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64", "8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src", "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le", "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x", "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information" } ] }
rhsa-2020_2448
Vulnerability from csaf_redhat
Published
2020-06-17 20:17
Modified
2024-11-05 22:19
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift security update
Notes
Topic
An update for openshift is now available for Red Hat OpenShift Container Platform 4.4.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openshift is now available for Red Hat OpenShift Container Platform 4.4.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2448", "url": "https://access.redhat.com/errata/RHSA-2020:2448" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1821583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2448.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift security update", "tracking": { "current_release_date": "2024-11-05T22:19:08+00:00", "generator": { "date": "2024-11-05T22:19:08+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2020:2448", "initial_release_date": "2020-06-17T20:17:45+00:00", "revision_history": [ { "date": "2020-06-17T20:17:45+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-06-17T20:17:45+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T22:19:08+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.4", "product": { "name": "Red Hat OpenShift Container Platform 4.4", "product_id": "8Base-RHOSE-4.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.4::el8" } } }, { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.4", "product": { "name": "Red Hat OpenShift Container Platform 4.4", "product_id": "7Server-RH7-RHOSE-4.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.4::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src", "product": { "name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src", "product_id": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift@4.4.0-202006061254.git.1.dc84fb4.el8?arch=src" } } }, { "category": "product_version", "name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src", "product": { "name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src", "product_id": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift@4.4.0-202006061254.git.1.dc84fb4.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64", "product": { "name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64", "product_id": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.4.0-202006061254.git.1.dc84fb4.el8?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64", "product": { "name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64", "product_id": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.4.0-202006061254.git.1.dc84fb4.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src as a component of Red Hat OpenShift Container Platform 4.4", "product_id": "7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src" }, "product_reference": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4", "product_id": "7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64" }, "product_reference": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src as a component of Red Hat OpenShift Container Platform 4.4", "product_id": "8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src" }, "product_reference": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4", "product_id": "8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64" }, "product_reference": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.4" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Kubernetes Product Security Committee" ] }, { "names": [ "Brice Augras" ], "organization": "Groupe-Asten", "summary": "Acknowledged by upstream." }, { "names": [ "Christophe Hauquiert" ], "organization": "Nokia", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-8555", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2020-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1821583" } ], "notes": [ { "category": "description", "text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src", "7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64", "8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src", "8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8555" }, { "category": "external", "summary": "RHBZ#1821583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8555" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30" } ], "release_date": "2020-06-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-06-17T20:17:45+00:00", "details": "For OpenShift Container Platform 4.4 see the following documentation, which\nwill be updated shortly for release 4.4.8, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src", "7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64", "8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src", "8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2448" }, { "category": "workaround", "details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC", "product_ids": [ "7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src", "7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64", "8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src", "8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src", "7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64", "8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src", "8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information" } ] }
rhsa-2020_2479
Vulnerability from csaf_redhat
Published
2020-06-18 21:12
Modified
2024-11-05 22:19
Summary
Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update
Notes
Topic
An update for atomic-openshift is now available for Red Hat OpenShift Container Platform 3.11.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.
Security Fix(es):
* libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions (CVE-2017-18367)
* kubernetes: Denial of service in API server via crafted YAML payloads by authorized users (CVE-2019-11254)
* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for atomic-openshift is now available for Red Hat OpenShift Container Platform 3.11.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenShift Enterprise by Red Hat is the company\u0027s cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments. \n\nSecurity Fix(es):\n\n* libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions (CVE-2017-18367)\n\n* kubernetes: Denial of service in API server via crafted YAML payloads by authorized users (CVE-2019-11254)\n\n* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2479", "url": "https://access.redhat.com/errata/RHSA-2020:2479" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1706826", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706826" }, { "category": "external", "summary": "1819486", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819486" }, { "category": "external", "summary": "1821583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2479.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update", "tracking": { "current_release_date": "2024-11-05T22:19:53+00:00", "generator": { "date": "2024-11-05T22:19:53+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2020:2479", "initial_release_date": "2020-06-18T21:12:56+00:00", "revision_history": [ { "date": "2020-06-18T21:12:56+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-06-18T21:12:56+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T22:19:53+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 3.11", "product": { "name": "Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3.11::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product": { "name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_id": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product": { "name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_id": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product": { "name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_id": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hyperkube@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product": { "name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_id": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hypershift@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product": { "name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_id": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-master@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product": { "name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_id": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-node@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product": { "name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_id": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-pod@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product": { "name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_id": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product": { "name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_id": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-template-service-broker@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product": { "name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_id": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-tests@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product": { "name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_id": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product": { "name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_id": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product": { "name": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_id": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients-redistributable@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product": { "name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_id": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hyperkube@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product": { "name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_id": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hypershift@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product": { "name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_id": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-master@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product": { "name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_id": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-node@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product": { "name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_id": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-pod@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product": { "name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_id": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product": { "name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_id": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-template-service-broker@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product": { "name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_id": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-tests@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "product": { "name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "product_id": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.11.232-1.git.0.a5bc32f.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "product": { "name": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "product_id": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-docker-excluder@3.11.232-1.git.0.a5bc32f.el7?arch=noarch" } } }, { "category": "product_version", "name": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "product": { "name": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "product_id": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-excluder@3.11.232-1.git.0.a5bc32f.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le" }, "product_reference": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src" }, "product_reference": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" }, "product_reference": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le" }, "product_reference": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" }, "product_reference": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" }, "product_reference": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch" }, "product_reference": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch" }, "product_reference": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le" }, "product_reference": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" }, "product_reference": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le" }, "product_reference": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" }, "product_reference": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le" }, "product_reference": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" }, "product_reference": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le" }, "product_reference": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" }, "product_reference": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le" }, "product_reference": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" }, "product_reference": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le" }, "product_reference": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" }, "product_reference": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le" }, "product_reference": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" }, "product_reference": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le" }, "product_reference": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" }, "product_reference": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-18367", "cwe": { "id": "CWE-305", "name": "Authentication Bypass by Primary Weakness" }, "discovery_date": "2019-04-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1706826" } ], "notes": [ { "category": "description", "text": "libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.", "title": "Vulnerability description" }, { "category": "summary", "text": "libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue may affect OpenShift Container Platform 3.x and 4.x if you are providing a custom Seccomp profile using Security Context Constraints [1]. The custom Seccomp profile would need to specify multiple arguments, such as below, from [2].\n\n{\n \"names\": [\n \"socketcall\"\n ],\n \"action\": \"SCMP_ACT_ALLOW\",\n \"args\": [\n {\n \"index\": 0,\n \"value\": 1,\n \"valueTwo\": 0,\n \"op\": \"SCMP_CMP_EQ\"\n },\n {\n \"index\": 1,\n \"value\": 1,\n \"valueTwo\": 0,\n \"op\": \"SCMP_CMP_EQ\"\n }\n ],\n \"comment\": \"\",\n \"includes\": {},\n \"excludes\": {}\n},\n\nIf such a profile was used the arguments could be combined as an OR rule, not AND, as the user might expect from Seccomp.\n\n[1] https://docs.openshift.com/container-platform/4.1/authentication/managing-security-context-constraints.html\n\n[2] https://github.com/moby/moby/issues/32714#issuecomment-295532163", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2017-18367" }, { "category": "external", "summary": "RHBZ#1706826", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706826" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2017-18367", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18367" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-18367", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18367" } ], "release_date": "2019-04-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-06-18T21:12:56+00:00", "details": "See the following documentation, which will be updated shortly for release\n3.11.232, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.", "product_ids": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2479" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions" }, { "cve": "CVE-2019-11254", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-04-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1819486" } ], "notes": [ { "category": "description", "text": "The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: Denial of service in API server via crafted YAML payloads by authorized users", "title": "Vulnerability summary" }, { "category": "other", "text": "The upstream Kubernetes fix for this vulnerability is to update the version of the Go dependency, gopkg.in/yaml.v2. This issue affects OpenShift Container Platform components that use versions before 2.2.8 of gopkg.in/yaml.v2 and accept YAML payloads.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11254" }, { "category": "external", "summary": "RHBZ#1819486", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819486" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11254", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11254" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11254", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11254" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc" } ], "release_date": "2020-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-06-18T21:12:56+00:00", "details": "See the following documentation, which will be updated shortly for release\n3.11.232, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.", "product_ids": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2479" }, { "category": "workaround", "details": "Prevent unauthenticated or unauthorized access to the API server", "product_ids": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: Denial of service in API server via crafted YAML payloads by authorized users" }, { "acknowledgments": [ { "names": [ "the Kubernetes Product Security Committee" ] }, { "names": [ "Brice Augras" ], "organization": "Groupe-Asten", "summary": "Acknowledged by upstream." }, { "names": [ "Christophe Hauquiert" ], "organization": "Nokia", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-8555", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2020-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1821583" } ], "notes": [ { "category": "description", "text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8555" }, { "category": "external", "summary": "RHBZ#1821583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8555" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30" } ], "release_date": "2020-06-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-06-18T21:12:56+00:00", "details": "See the following documentation, which will be updated shortly for release\n3.11.232, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.", "product_ids": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2479" }, { "category": "workaround", "details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC", "product_ids": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information" } ] }
rhsa-2020_2449
Vulnerability from csaf_redhat
Published
2020-06-17 21:28
Modified
2024-11-05 22:19
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift-enterprise-hyperkube-container security update
Notes
Topic
An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.4.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.4.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2449", "url": "https://access.redhat.com/errata/RHSA-2020:2449" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1821583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2449.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift-enterprise-hyperkube-container security update", "tracking": { "current_release_date": "2024-11-05T22:19:16+00:00", "generator": { "date": "2024-11-05T22:19:16+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2020:2449", "initial_release_date": "2020-06-17T21:28:57+00:00", "revision_history": [ { "date": "2020-06-17T21:28:57+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-06-17T21:28:57+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T22:19:16+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.4", "product": { "name": "Red Hat OpenShift Container Platform 4.4", "product_id": "7Server-RH7-RHOSE-4.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.4::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64", "product": { "name": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64", "product_id": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64", "product_identification_helper": { "purl": "pkg:oci/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.4.0-202006080610" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x", "product": { "name": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x", "product_id": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x", "product_identification_helper": { "purl": "pkg:oci/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd?arch=s390x\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.4.0-202006080610" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le", "product": { "name": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le", "product_id": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le", "product_identification_helper": { "purl": "pkg:oci/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.4.0-202006080610" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x as a component of Red Hat OpenShift Container Platform 4.4", "product_id": "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x" }, "product_reference": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x", "relates_to_product_reference": "7Server-RH7-RHOSE-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le as a component of Red Hat OpenShift Container Platform 4.4", "product_id": "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le" }, "product_reference": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64 as a component of Red Hat OpenShift Container Platform 4.4", "product_id": "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64" }, "product_reference": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.4" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Kubernetes Product Security Committee" ] }, { "names": [ "Brice Augras" ], "organization": "Groupe-Asten", "summary": "Acknowledged by upstream." }, { "names": [ "Christophe Hauquiert" ], "organization": "Nokia", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-8555", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2020-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1821583" } ], "notes": [ { "category": "description", "text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x", "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le", "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8555" }, { "category": "external", "summary": "RHBZ#1821583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8555" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30" } ], "release_date": "2020-06-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-06-17T21:28:57+00:00", "details": "For OpenShift Container Platform 4.4 see the following documentation, which\nwill be updated shortly for release 4.4.8, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x", "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le", "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2449" }, { "category": "workaround", "details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC", "product_ids": [ "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x", "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le", "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x", "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le", "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information" } ] }
rhsa-2020_2594
Vulnerability from csaf_redhat
Published
2020-07-01 16:04
Modified
2024-11-05 22:21
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.2.36 openshift security update
Notes
Topic
An update for openshift is now available for Red Hat OpenShift Container Platform 4.2.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openshift is now available for Red Hat OpenShift Container Platform 4.2.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2594", "url": "https://access.redhat.com/errata/RHSA-2020:2594" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1821583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2594.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.2.36 openshift security update", "tracking": { "current_release_date": "2024-11-05T22:21:59+00:00", "generator": { "date": "2024-11-05T22:21:59+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2020:2594", "initial_release_date": "2020-07-01T16:04:47+00:00", "revision_history": [ { "date": "2020-07-01T16:04:47+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-01T16:04:47+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T22:21:59+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.2", "product": { "name": "Red Hat OpenShift Container Platform 4.2", "product_id": "7Server-RH7-RHOSE-4.2", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.2::el7" } } }, { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.2", "product": { "name": "Red Hat OpenShift Container Platform 4.2", "product_id": "8Base-RHOSE-4.2", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.2::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src", "product": { "name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src", "product_id": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift@4.2.36-202006211650.p0.git.0.1fe246f.el7?arch=src" } } }, { "category": "product_version", "name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src", "product": { "name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src", "product_id": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift@4.2.36-202006211650.p0.git.0.1fe246f.el8?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64", "product": { "name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64", "product_id": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.2.36-202006211650.p0.git.0.1fe246f.el7?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64", "product": { "name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64", "product_id": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.2.36-202006211650.p0.git.0.1fe246f.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x", "product": { "name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x", "product_id": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.2.36-202006211650.p0.git.0.1fe246f.el8?arch=s390x" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src as a component of Red Hat OpenShift Container Platform 4.2", "product_id": "7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src" }, "product_reference": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-4.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.2", "product_id": "7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64" }, "product_reference": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src as a component of Red Hat OpenShift Container Platform 4.2", "product_id": "8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src" }, "product_reference": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x as a component of Red Hat OpenShift Container Platform 4.2", "product_id": "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x" }, "product_reference": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x", "relates_to_product_reference": "8Base-RHOSE-4.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.2", "product_id": "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64" }, "product_reference": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.2" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Kubernetes Product Security Committee" ] }, { "names": [ "Brice Augras" ], "organization": "Groupe-Asten", "summary": "Acknowledged by upstream." }, { "names": [ "Christophe Hauquiert" ], "organization": "Nokia", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-8555", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2020-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1821583" } ], "notes": [ { "category": "description", "text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src", "7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64", "8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src", "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x", "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8555" }, { "category": "external", "summary": "RHBZ#1821583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8555" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30" } ], "release_date": "2020-06-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-01T16:04:47+00:00", "details": "For OpenShift Container Platform 4.2 see the following documentation, which\nwill be updated shortly for release 4.2.36, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.2/release_notes/ocp-4-2-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.2/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src", "7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64", "8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src", "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x", "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2594" }, { "category": "workaround", "details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC", "product_ids": [ "7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src", "7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64", "8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src", "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x", "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src", "7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64", "8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src", "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x", "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information" } ] }
gsd-2020-8555
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Aliases
Aliases
{ "GSD": { "alias": "CVE-2020-8555", "description": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).", "id": "GSD-2020-8555", "references": [ "https://www.suse.com/security/cve/CVE-2020-8555.html", "https://access.redhat.com/errata/RHSA-2020:2594", "https://access.redhat.com/errata/RHSA-2020:2479", "https://access.redhat.com/errata/RHSA-2020:2449", "https://access.redhat.com/errata/RHSA-2020:2448", "https://access.redhat.com/errata/RHSA-2020:2441", "https://access.redhat.com/errata/RHSA-2020:2440", "https://linux.oracle.com/cve/CVE-2020-8555.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2020-8555" ], "details": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).", "id": "GSD-2020-8555", "modified": "2023-12-13T01:21:53.665168Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "AKA": "", "ASSIGNER": "security@kubernetes.io", "DATE_PUBLIC": "", "ID": "CVE-2020-8555", "STATE": "PUBLIC", "TITLE": "Kubernetes kube-controller-manager SSRF" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Kubernetes", "version": { "version_data": [ { "platform": "", "version_affected": "\u003c", "version_name": "1.15", "version_value": "1.15.12" }, { "platform": "", "version_affected": "\u003c", "version_name": "1.16", "version_value": "1.16.9" }, { "platform": "", "version_affected": "\u003c", "version_name": "1.17", "version_value": "1.17.5" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.18.0" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.1" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.2" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.3" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.4" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.5" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.6" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.7" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.8" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.9" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.10" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.11" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.12" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.13" }, { "platform": "", "version_affected": "", "version_name": "", "version_value": "1.14" } ] } } ] }, "vendor_name": "Kubernetes" } ] } }, "configuration": [], "credit": [ { "lang": "eng", "value": "Brice Augras from Groupe-Asten and Christophe Hauquiert from Nokia" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services)." } ] }, "exploit": [], "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-918 Server-Side Request Forgery (SSRF)" } ] } ] }, "references": { "reference_data": [ { "name": "[oss-security] 20200601 CVE-2020-8555: Kubernetes: Half-Blind SSRF in kube-controller-manager", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2020/06/01/4" }, { "name": "", "refsource": "MLIST", "url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion" }, { "name": "https://github.com/kubernetes/kubernetes/issues/91542", "refsource": "CONFIRM", "url": "https://github.com/kubernetes/kubernetes/issues/91542" }, { "name": "FEDORA-2020-aeea04cd13", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/" }, { "name": "https://security.netapp.com/advisory/ntap-20200724-0005/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20200724-0005/" }, { "name": "[oss-security] 20210504 [kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2021/05/04/8" } ] }, "solution": [], "source": { "advisory": "", "defect": [ "https://github.com/kubernetes/kubernetes/issues/91542" ], "discovery": "EXTERNAL" }, "work_around": [ { "lang": "eng", "value": "Prior to upgrading, this vulnerability can be mitigated by adding endpoint protections on the master or restricting usage of the vulnerable volume types (for example by constraining usage with a PodSecurityPolicy or third-party admission controller such as Gatekeeper) and restricting StorageClass write permissions through RBAC." } ] }, "gitlab.com": { "advisories": [ { "affected_range": "\u003cv1.15.11 || \u003e=v1.16.0 \u003cv1.16.9 || \u003e=v1.17.0 \u003cv1.17.5 || =v1.18.0", "affected_versions": "All versions before 1.15.11, all versions starting from 1.16.0 before 1.16.9, all versions starting from 1.17.0 before 1.17.5, version 1.18.0", "cvss_v2": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-918", "CWE-937" ], "date": "2021-05-04", "description": "The Kubernetes kube-controller-manager is vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).", "fixed_versions": [ "v1.15.11", "v1.16.9", "v1.17.5", "v1.18.1-beta.0" ], "identifier": "CVE-2020-8555", "identifiers": [ "CVE-2020-8555" ], "not_impacted": "All versions starting from 1.15.11 before 1.16.0, all versions starting from 1.16.9 before 1.17.0, all versions starting from 1.17.5 before 1.18.0, all versions after 1.18.0", "package_slug": "go/github.com/kubernetes/kubernetes", "pubdate": "2020-06-05", "solution": "Upgrade to versions 1.15.11, 1.16.9, 1.17.5, 1.18.1-beta.0 or above. *Note*: 1.18.1-beta.0 may be an unstable version. Use caution.", "title": "Server-Side Request Forgery (SSRF)", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2020-8555" ], "uuid": "49421dfe-0e2d-413e-b572-b20d7a119e7a", "versions": [ { "commit": { "sha": "38d05c7c415152c9249ad0c553cbbcb86f247a68", "tags": [ "v1.16.0" ], "timestamp": "20190913145653" }, "number": "v1.16.0" }, { "commit": { "sha": "02a9c9f39a18ee40c37835c36c7c80e0797b0d85", "tags": [ "v1.17.0" ], "timestamp": "20191206012503" }, "number": "v1.17.0" }, { "commit": { "sha": "bc19501317000efb086595adb9ad5f3627a6d95a", "tags": [ "v1.15.11" ], "timestamp": "20200312205918" }, "number": "v1.15.11" }, { "commit": { "sha": "6ac870f868255d1d40ce3ac115b62f8d5e02e8a3", "tags": [ "v1.18.1-beta.0" ], "timestamp": "20200325144952" }, "number": "v1.18.1-beta.0" }, { "commit": { "sha": "f6cc41b23ef90243e9dbba5fbad501630caaa737", "tags": [ "v1.18.0" ], "timestamp": "20200325144952" }, "number": "v1.18.0" }, { "commit": { "sha": "270e315bf98d867a302bec5c1d0b9ed045708bf2", "tags": [ "v1.17.5" ], "timestamp": "20200416113457" }, "number": "v1.17.5" }, { "commit": { "sha": "9c4650b12ad33a2a41b0f474ec11c2bf1371658e", "tags": [ "v1.16.9" ], "timestamp": "20200416113528" }, "number": "v1.16.9" } ] }, { "affected_range": "\u003e=1.18.0 \u003c1.18.1||\u003e=1.17.0 \u003c1.17.4||\u003e=1.16.0 \u003c1.16.9||\u003c1.15.12", "affected_versions": "All versions starting from 1.18.0 before 1.18.1, all versions starting from 1.17.0 before 1.17.4, all versions starting from 1.16.0 before 1.16.9, all versions before 1.15.12", "cvss_v2": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-918", "CWE-937" ], "date": "2022-04-12", "description": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 is vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).", "fixed_versions": [ "1.18.1", "1.18.1", "1.16.9", "1.15.12", "1.15.12" ], "identifier": "CVE-2020-8555", "identifiers": [ "GHSA-x6mj-w4jf-jmgw", "CVE-2020-8555" ], "not_impacted": "All versions before 1.18.0, all versions starting from 1.18.1, all versions before 1.17.0, all versions starting from 1.17.4, all versions before 1.16.0, all versions starting from 1.15.12 before 1.16.9", "package_slug": "go/github.com/kubernetes/kubernetes/pkg/volume/storageos", "pubdate": "2022-02-15", "solution": "Upgrade to versions 1.18.1, 1.18.1, 1.16.9, 1.15.12, 1.15.12 or above.", "title": "Server-Side Request Forgery (SSRF)", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2020-8555", "https://github.com/kubernetes/kubernetes/issues/91542", "https://github.com/kubernetes/kubernetes/pull/89794", "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/", "https://security.netapp.com/advisory/ntap-20200724-0005/", "http://www.openwall.com/lists/oss-security/2020/06/01/4", "http://www.openwall.com/lists/oss-security/2021/05/04/8", "https://github.com/advisories/GHSA-x6mj-w4jf-jmgw" ], "uuid": "0df79936-304b-41b2-8141-a19199f9ddd8" }, { "affected_range": "\u003c1.15.11||\u003e=1.16.0 \u003c1.16.9||\u003e=1.17.0 \u003c1.17.5||\u003e=1.18.0 \u003c1.18.1", "affected_versions": "All versions before 1.15.11, all versions starting from 1.16.0 before 1.16.9, all versions starting from 1.17.0 before 1.17.5, version 1.18.0", "cvss_v2": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-918", "CWE-937" ], "date": "2021-05-04", "description": "The Kubernetes kube-controller-manager is vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).", "fixed_versions": [ "1.15.11", "1.16.9", "1.17.5", "1.18.1" ], "identifier": "CVE-2020-8555", "identifiers": [ "CVE-2020-8555" ], "not_impacted": "All versions starting from 1.15.11 before 1.16.0, all versions starting from 1.17.5 before 1.18.0, all versions starting from 1.18.1", "package_slug": "go/k8s.io/kubernetes/pkg/apis/apps/validation", "pubdate": "2020-06-05", "solution": "Upgrade to version 1.15.11, 1.16.9, 1.17.5, 1.18.1 or above.", "title": "Server-Side Request Forgery (SSRF)", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2020-8555" ], "uuid": "17a622d8-557c-4209-9a96-aa69e3d747eb" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:1.18.0:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.15.11", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.17.5", "versionStartIncluding": "1.17.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.16.9", "versionStartIncluding": "1.16.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "security@kubernetes.io", "ID": "CVE-2020-8555" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services)." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-918" } ] } ] }, "references": { "reference_data": [ { "name": "N/A", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion" }, { "name": "https://github.com/kubernetes/kubernetes/issues/91542", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://github.com/kubernetes/kubernetes/issues/91542" }, { "name": "[oss-security] 20200601 CVE-2020-8555: Kubernetes: Half-Blind SSRF in kube-controller-manager", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2020/06/01/4" }, { "name": "FEDORA-2020-aeea04cd13", "refsource": "FEDORA", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/" }, { "name": "https://security.netapp.com/advisory/ntap-20200724-0005/", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://security.netapp.com/advisory/ntap-20200724-0005/" }, { "name": "[oss-security] 20210504 [kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2021/05/04/8" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0" }, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 4.0 } }, "lastModifiedDate": "2022-11-16T03:39Z", "publishedDate": "2020-06-05T17:15Z" } } }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.