Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-8555 (GCVE-0-2020-8555)
Vulnerability from cvelistv5 – Published: 2020-06-04 21:50 – Updated: 2024-09-16 18:39
VLAI?
EPSS
Summary
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Severity ?
6.3 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Kubernetes | Kubernetes |
Affected:
1.18.0
Affected: 1.1 Affected: 1.2 Affected: 1.3 Affected: 1.4 Affected: 1.5 Affected: 1.6 Affected: 1.7 Affected: 1.8 Affected: 1.9 Affected: 1.10 Affected: 1.11 Affected: 1.12 Affected: 1.13 Affected: 1.14 Affected: 1.15 , < 1.15.12 (custom) Affected: 1.16 , < 1.16.9 (custom) Affected: 1.17 , < 1.17.5 (custom) |
Credits
Brice Augras from Groupe-Asten and Christophe Hauquiert from Nokia
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:03:46.110Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20200601 CVE-2020-8555: Kubernetes: Half-Blind SSRF in kube-controller-manager",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2020/06/01/4"
},
{
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/kubernetes/kubernetes/issues/91542"
},
{
"name": "FEDORA-2020-aeea04cd13",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20200724-0005/"
},
{
"name": "[oss-security] 20210504 [kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/05/04/8"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Kubernetes",
"vendor": "Kubernetes",
"versions": [
{
"status": "affected",
"version": "1.18.0"
},
{
"status": "affected",
"version": "1.1"
},
{
"status": "affected",
"version": "1.2"
},
{
"status": "affected",
"version": "1.3"
},
{
"status": "affected",
"version": "1.4"
},
{
"status": "affected",
"version": "1.5"
},
{
"status": "affected",
"version": "1.6"
},
{
"status": "affected",
"version": "1.7"
},
{
"status": "affected",
"version": "1.8"
},
{
"status": "affected",
"version": "1.9"
},
{
"status": "affected",
"version": "1.10"
},
{
"status": "affected",
"version": "1.11"
},
{
"status": "affected",
"version": "1.12"
},
{
"status": "affected",
"version": "1.13"
},
{
"status": "affected",
"version": "1.14"
},
{
"lessThan": "1.15.12",
"status": "affected",
"version": "1.15",
"versionType": "custom"
},
{
"lessThan": "1.16.9",
"status": "affected",
"version": "1.16",
"versionType": "custom"
},
{
"lessThan": "1.17.5",
"status": "affected",
"version": "1.17",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Brice Augras from Groupe-Asten and Christophe Hauquiert from Nokia"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-04T20:06:18",
"orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"shortName": "kubernetes"
},
"references": [
{
"name": "[oss-security] 20200601 CVE-2020-8555: Kubernetes: Half-Blind SSRF in kube-controller-manager",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2020/06/01/4"
},
{
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubernetes/kubernetes/issues/91542"
},
{
"name": "FEDORA-2020-aeea04cd13",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20200724-0005/"
},
{
"name": "[oss-security] 20210504 [kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2021/05/04/8"
}
],
"source": {
"defect": [
"https://github.com/kubernetes/kubernetes/issues/91542"
],
"discovery": "EXTERNAL"
},
"title": "Kubernetes kube-controller-manager SSRF",
"workarounds": [
{
"lang": "en",
"value": "Prior to upgrading, this vulnerability can be mitigated by adding endpoint protections on the master or restricting usage of the vulnerable volume types (for example by constraining usage with a PodSecurityPolicy or third-party admission controller such as Gatekeeper) and restricting StorageClass write permissions through RBAC."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "",
"ASSIGNER": "security@kubernetes.io",
"DATE_PUBLIC": "",
"ID": "CVE-2020-8555",
"STATE": "PUBLIC",
"TITLE": "Kubernetes kube-controller-manager SSRF"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Kubernetes",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "\u003c",
"version_name": "1.15",
"version_value": "1.15.12"
},
{
"platform": "",
"version_affected": "\u003c",
"version_name": "1.16",
"version_value": "1.16.9"
},
{
"platform": "",
"version_affected": "\u003c",
"version_name": "1.17",
"version_value": "1.17.5"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.18.0"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.1"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.2"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.3"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.4"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.5"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.6"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.7"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.8"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.9"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.10"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.11"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.12"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.13"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.14"
}
]
}
}
]
},
"vendor_name": "Kubernetes"
}
]
}
},
"configuration": [],
"credit": [
{
"lang": "eng",
"value": "Brice Augras from Groupe-Asten and Christophe Hauquiert from Nokia"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services)."
}
]
},
"exploit": [],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-918 Server-Side Request Forgery (SSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20200601 CVE-2020-8555: Kubernetes: Half-Blind SSRF in kube-controller-manager",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2020/06/01/4"
},
{
"name": "",
"refsource": "MLIST",
"url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion"
},
{
"name": "https://github.com/kubernetes/kubernetes/issues/91542",
"refsource": "CONFIRM",
"url": "https://github.com/kubernetes/kubernetes/issues/91542"
},
{
"name": "FEDORA-2020-aeea04cd13",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200724-0005/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200724-0005/"
},
{
"name": "[oss-security] 20210504 [kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2021/05/04/8"
}
]
},
"solution": [],
"source": {
"advisory": "",
"defect": [
"https://github.com/kubernetes/kubernetes/issues/91542"
],
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Prior to upgrading, this vulnerability can be mitigated by adding endpoint protections on the master or restricting usage of the vulnerable volume types (for example by constraining usage with a PodSecurityPolicy or third-party admission controller such as Gatekeeper) and restricting StorageClass write permissions through RBAC."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"assignerShortName": "kubernetes",
"cveId": "CVE-2020-8555",
"datePublished": "2020-06-04T21:50:11.749943Z",
"dateReserved": "2020-02-03T00:00:00",
"dateUpdated": "2024-09-16T18:39:58.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.15.11\", \"matchCriteriaId\": \"1BB84B14-8D71-4BEA-90FC-DB76F9A0F781\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.16.0\", \"versionEndExcluding\": \"1.16.9\", \"matchCriteriaId\": \"111CE2DC-82F8-4AF6-99B6-5BB847A18D95\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.17.0\", \"versionEndExcluding\": \"1.17.5\", \"matchCriteriaId\": \"9D5D5658-D416-434A-BA64-74DA2A4F13E2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:kubernetes:kubernetes:1.18.0:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF65B08E-28BD-496F-88AE-CB7271BD7379\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"36D96259-24BD-44E2-96D9-78CE1D41F956\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).\"}, {\"lang\": \"es\", \"value\": \"El Kubernetes kube-controller-manager en las versiones v1.0-1.14, versiones anteriores a v1.15.12, v1.16.9, v1.17.5 y v1.18.0, son vulnerables a un ataque de tipo Server Side Request Forgery (SSRF) que permite que determinados usuarios autorizados pierdan hasta 500 bytes de informaci\\u00f3n arbitraria de endpoints desprotegidos dentro de la red host del maestro (tales como los servicios link-local o loopback)\"}]",
"id": "CVE-2020-8555",
"lastModified": "2024-11-21T05:39:01.533",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"jordan@liggitt.net\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 4.0}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 4.0}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:S/C:P/I:N/A:N\", \"baseScore\": 3.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 6.8, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2020-06-05T17:15:11.640",
"references": "[{\"url\": \"http://www.openwall.com/lists/oss-security/2020/06/01/4\", \"source\": \"jordan@liggitt.net\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/05/04/8\", \"source\": \"jordan@liggitt.net\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/kubernetes/kubernetes/issues/91542\", \"source\": \"jordan@liggitt.net\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion\", \"source\": \"jordan@liggitt.net\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/\", \"source\": \"jordan@liggitt.net\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20200724-0005/\", \"source\": \"jordan@liggitt.net\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2020/06/01/4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/05/04/8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/kubernetes/kubernetes/issues/91542\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20200724-0005/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
"sourceIdentifier": "jordan@liggitt.net",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"jordan@liggitt.net\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-918\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-918\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2020-8555\",\"sourceIdentifier\":\"jordan@liggitt.net\",\"published\":\"2020-06-05T17:15:11.640\",\"lastModified\":\"2024-11-21T05:39:01.533\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).\"},{\"lang\":\"es\",\"value\":\"El Kubernetes kube-controller-manager en las versiones v1.0-1.14, versiones anteriores a v1.15.12, v1.16.9, v1.17.5 y v1.18.0, son vulnerables a un ataque de tipo Server Side Request Forgery (SSRF) que permite que determinados usuarios autorizados pierdan hasta 500 bytes de informaci\u00f3n arbitraria de endpoints desprotegidos dentro de la red host del maestro (tales como los servicios link-local o loopback)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"jordan@liggitt.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":4.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":4.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:P/I:N/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"jordan@liggitt.net\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.15.11\",\"matchCriteriaId\":\"1BB84B14-8D71-4BEA-90FC-DB76F9A0F781\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.16.0\",\"versionEndExcluding\":\"1.16.9\",\"matchCriteriaId\":\"111CE2DC-82F8-4AF6-99B6-5BB847A18D95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.17.0\",\"versionEndExcluding\":\"1.17.5\",\"matchCriteriaId\":\"9D5D5658-D416-434A-BA64-74DA2A4F13E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:kubernetes:1.18.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF65B08E-28BD-496F-88AE-CB7271BD7379\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D96259-24BD-44E2-96D9-78CE1D41F956\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2020/06/01/4\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/05/04/8\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/kubernetes/kubernetes/issues/91542\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/\",\"source\":\"jordan@liggitt.net\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20200724-0005/\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2020/06/01/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/05/04/8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/kubernetes/kubernetes/issues/91542\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20200724-0005/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
RHSA-2020:2594
Vulnerability from csaf_redhat - Published: 2020-07-01 16:04 - Updated: 2025-11-21 18:14Summary
Red Hat Security Advisory: OpenShift Container Platform 4.2.36 openshift security update
Notes
Topic
An update for openshift is now available for Red Hat OpenShift Container Platform 4.2.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for openshift is now available for Red Hat OpenShift Container Platform 4.2.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2594",
"url": "https://access.redhat.com/errata/RHSA-2020:2594"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2594.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.2.36 openshift security update",
"tracking": {
"current_release_date": "2025-11-21T18:14:57+00:00",
"generator": {
"date": "2025-11-21T18:14:57+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2020:2594",
"initial_release_date": "2020-07-01T16:04:47+00:00",
"revision_history": [
{
"date": "2020-07-01T16:04:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-07-01T16:04:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T18:14:57+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.2",
"product": {
"name": "Red Hat OpenShift Container Platform 4.2",
"product_id": "7Server-RH7-RHOSE-4.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.2",
"product": {
"name": "Red Hat OpenShift Container Platform 4.2",
"product_id": "8Base-RHOSE-4.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.2::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"product": {
"name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"product_id": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift@4.2.36-202006211650.p0.git.0.1fe246f.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"product": {
"name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"product_id": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift@4.2.36-202006211650.p0.git.0.1fe246f.el8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"product": {
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"product_id": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.2.36-202006211650.p0.git.0.1fe246f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64",
"product": {
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64",
"product_id": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.2.36-202006211650.p0.git.0.1fe246f.el8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"product": {
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"product_id": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.2.36-202006211650.p0.git.0.1fe246f.el8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src as a component of Red Hat OpenShift Container Platform 4.2",
"product_id": "7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src"
},
"product_reference": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.2",
"product_id": "7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64"
},
"product_reference": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src as a component of Red Hat OpenShift Container Platform 4.2",
"product_id": "8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src"
},
"product_reference": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"relates_to_product_reference": "8Base-RHOSE-4.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x as a component of Red Hat OpenShift Container Platform 4.2",
"product_id": "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x"
},
"product_reference": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"relates_to_product_reference": "8Base-RHOSE-4.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.2",
"product_id": "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64"
},
"product_reference": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64",
"relates_to_product_reference": "8Base-RHOSE-4.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Kubernetes Product Security Committee"
]
},
{
"names": [
"Brice Augras"
],
"organization": "Groupe-Asten",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Christophe Hauquiert"
],
"organization": "Nokia",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-8555",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-04-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1821583"
}
],
"notes": [
{
"category": "description",
"text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "RHBZ#1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30"
}
],
"release_date": "2020-06-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-07-01T16:04:47+00:00",
"details": "For OpenShift Container Platform 4.2 see the following documentation, which\nwill be updated shortly for release 4.2.36, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.2/release_notes/ocp-4-2-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.2/updating/updating-cluster-cli.html.",
"product_ids": [
"7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2594"
},
{
"category": "workaround",
"details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC",
"product_ids": [
"7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information"
}
]
}
RHSA-2020_2448
Vulnerability from csaf_redhat - Published: 2020-06-17 20:17 - Updated: 2024-11-22 15:21Summary
Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift security update
Notes
Topic
An update for openshift is now available for Red Hat OpenShift Container Platform 4.4.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for openshift is now available for Red Hat OpenShift Container Platform 4.4.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2448",
"url": "https://access.redhat.com/errata/RHSA-2020:2448"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2448.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift security update",
"tracking": {
"current_release_date": "2024-11-22T15:21:46+00:00",
"generator": {
"date": "2024-11-22T15:21:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2020:2448",
"initial_release_date": "2020-06-17T20:17:45+00:00",
"revision_history": [
{
"date": "2020-06-17T20:17:45+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-06-17T20:17:45+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:21:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.4",
"product": {
"name": "Red Hat OpenShift Container Platform 4.4",
"product_id": "8Base-RHOSE-4.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.4::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.4",
"product": {
"name": "Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.4::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"product": {
"name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"product_id": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift@4.4.0-202006061254.git.1.dc84fb4.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"product": {
"name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"product_id": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift@4.4.0-202006061254.git.1.dc84fb4.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64",
"product": {
"name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64",
"product_id": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.4.0-202006061254.git.1.dc84fb4.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"product": {
"name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"product_id": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.4.0-202006061254.git.1.dc84fb4.el7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src"
},
"product_reference": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64"
},
"product_reference": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src"
},
"product_reference": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"relates_to_product_reference": "8Base-RHOSE-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64"
},
"product_reference": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64",
"relates_to_product_reference": "8Base-RHOSE-4.4"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Kubernetes Product Security Committee"
]
},
{
"names": [
"Brice Augras"
],
"organization": "Groupe-Asten",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Christophe Hauquiert"
],
"organization": "Nokia",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-8555",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-04-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1821583"
}
],
"notes": [
{
"category": "description",
"text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "RHBZ#1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30"
}
],
"release_date": "2020-06-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-17T20:17:45+00:00",
"details": "For OpenShift Container Platform 4.4 see the following documentation, which\nwill be updated shortly for release 4.4.8, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.",
"product_ids": [
"7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2448"
},
{
"category": "workaround",
"details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC",
"product_ids": [
"7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information"
}
]
}
RHSA-2020_2594
Vulnerability from csaf_redhat - Published: 2020-07-01 16:04 - Updated: 2024-11-22 15:22Summary
Red Hat Security Advisory: OpenShift Container Platform 4.2.36 openshift security update
Notes
Topic
An update for openshift is now available for Red Hat OpenShift Container Platform 4.2.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for openshift is now available for Red Hat OpenShift Container Platform 4.2.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2594",
"url": "https://access.redhat.com/errata/RHSA-2020:2594"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2594.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.2.36 openshift security update",
"tracking": {
"current_release_date": "2024-11-22T15:22:10+00:00",
"generator": {
"date": "2024-11-22T15:22:10+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2020:2594",
"initial_release_date": "2020-07-01T16:04:47+00:00",
"revision_history": [
{
"date": "2020-07-01T16:04:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-07-01T16:04:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:22:10+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.2",
"product": {
"name": "Red Hat OpenShift Container Platform 4.2",
"product_id": "7Server-RH7-RHOSE-4.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.2",
"product": {
"name": "Red Hat OpenShift Container Platform 4.2",
"product_id": "8Base-RHOSE-4.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.2::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"product": {
"name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"product_id": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift@4.2.36-202006211650.p0.git.0.1fe246f.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"product": {
"name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"product_id": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift@4.2.36-202006211650.p0.git.0.1fe246f.el8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"product": {
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"product_id": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.2.36-202006211650.p0.git.0.1fe246f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64",
"product": {
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64",
"product_id": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.2.36-202006211650.p0.git.0.1fe246f.el8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"product": {
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"product_id": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.2.36-202006211650.p0.git.0.1fe246f.el8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src as a component of Red Hat OpenShift Container Platform 4.2",
"product_id": "7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src"
},
"product_reference": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.2",
"product_id": "7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64"
},
"product_reference": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src as a component of Red Hat OpenShift Container Platform 4.2",
"product_id": "8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src"
},
"product_reference": "openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"relates_to_product_reference": "8Base-RHOSE-4.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x as a component of Red Hat OpenShift Container Platform 4.2",
"product_id": "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x"
},
"product_reference": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"relates_to_product_reference": "8Base-RHOSE-4.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.2",
"product_id": "8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64"
},
"product_reference": "openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64",
"relates_to_product_reference": "8Base-RHOSE-4.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Kubernetes Product Security Committee"
]
},
{
"names": [
"Brice Augras"
],
"organization": "Groupe-Asten",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Christophe Hauquiert"
],
"organization": "Nokia",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-8555",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-04-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1821583"
}
],
"notes": [
{
"category": "description",
"text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "RHBZ#1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30"
}
],
"release_date": "2020-06-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-07-01T16:04:47+00:00",
"details": "For OpenShift Container Platform 4.2 see the following documentation, which\nwill be updated shortly for release 4.2.36, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.2/release_notes/ocp-4-2-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.2/updating/updating-cluster-cli.html.",
"product_ids": [
"7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2594"
},
{
"category": "workaround",
"details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC",
"product_ids": [
"7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.src",
"7Server-RH7-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64",
"8Base-RHOSE-4.2:openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.src",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x",
"8Base-RHOSE-4.2:openshift-hyperkube-0:4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information"
}
]
}
RHSA-2020_2440
Vulnerability from csaf_redhat - Published: 2020-06-17 19:44 - Updated: 2024-11-22 15:21Summary
Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift security update
Notes
Topic
An update for openshift is now available for Red Hat OpenShift Container Platform 4.3.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: A server side request forgery (SSRF) in the kube-controller-manager allows certain authorized users to leak up to 500 bytes of arbitrary information from the master's host network (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for openshift is now available for Red Hat OpenShift Container Platform 4.3.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: A server side request forgery (SSRF) in the kube-controller-manager allows certain authorized users to leak up to 500 bytes of arbitrary information from the master\u0027s host network (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2440",
"url": "https://access.redhat.com/errata/RHSA-2020:2440"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2440.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift security update",
"tracking": {
"current_release_date": "2024-11-22T15:21:29+00:00",
"generator": {
"date": "2024-11-22T15:21:29+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2020:2440",
"initial_release_date": "2020-06-17T19:44:13+00:00",
"revision_history": [
{
"date": "2020-06-17T19:44:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-06-17T19:44:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:21:29+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.3",
"product": {
"name": "Red Hat OpenShift Container Platform 4.3",
"product_id": "8Base-RHOSE-4.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.3::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.3",
"product": {
"name": "Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.3::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"product": {
"name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"product_id": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift@4.3.25-202006060952.git.1.96c30f6.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"product": {
"name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"product_id": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift@4.3.25-202006060952.git.1.96c30f6.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"product": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"product": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el7?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"product": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"product": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el7?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64",
"product": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64",
"product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"product": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src"
},
"product_reference": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le"
},
"product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x"
},
"product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64"
},
"product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src"
},
"product_reference": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"relates_to_product_reference": "8Base-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le"
},
"product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"relates_to_product_reference": "8Base-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x"
},
"product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"relates_to_product_reference": "8Base-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64"
},
"product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64",
"relates_to_product_reference": "8Base-RHOSE-4.3"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Kubernetes Product Security Committee"
]
},
{
"names": [
"Brice Augras"
],
"organization": "Groupe-Asten",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Christophe Hauquiert"
],
"organization": "Nokia",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-8555",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-04-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1821583"
}
],
"notes": [
{
"category": "description",
"text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "RHBZ#1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30"
}
],
"release_date": "2020-06-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-17T19:44:13+00:00",
"details": "For OpenShift Container Platform 4.3 see the following documentation, which\nwill be updated shortly for release 4.3.25, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.",
"product_ids": [
"7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2440"
},
{
"category": "workaround",
"details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC",
"product_ids": [
"7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information"
}
]
}
RHSA-2020_2449
Vulnerability from csaf_redhat - Published: 2020-06-17 21:28 - Updated: 2024-11-22 15:21Summary
Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift-enterprise-hyperkube-container security update
Notes
Topic
An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.4.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.4.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2449",
"url": "https://access.redhat.com/errata/RHSA-2020:2449"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2449.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift-enterprise-hyperkube-container security update",
"tracking": {
"current_release_date": "2024-11-22T15:21:54+00:00",
"generator": {
"date": "2024-11-22T15:21:54+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2020:2449",
"initial_release_date": "2020-06-17T21:28:57+00:00",
"revision_history": [
{
"date": "2020-06-17T21:28:57+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-06-17T21:28:57+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:21:54+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.4",
"product": {
"name": "Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.4::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64",
"product": {
"name": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64",
"product_id": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.4.0-202006080610"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"product": {
"name": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"product_id": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"product_identification_helper": {
"purl": "pkg:oci/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd?arch=s390x\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.4.0-202006080610"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"product": {
"name": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"product_id": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.4.0-202006080610"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x"
},
"product_reference": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le"
},
"product_reference": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64 as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64"
},
"product_reference": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.4"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Kubernetes Product Security Committee"
]
},
{
"names": [
"Brice Augras"
],
"organization": "Groupe-Asten",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Christophe Hauquiert"
],
"organization": "Nokia",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-8555",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-04-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1821583"
}
],
"notes": [
{
"category": "description",
"text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "RHBZ#1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30"
}
],
"release_date": "2020-06-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-17T21:28:57+00:00",
"details": "For OpenShift Container Platform 4.4 see the following documentation, which\nwill be updated shortly for release 4.4.8, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.",
"product_ids": [
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2449"
},
{
"category": "workaround",
"details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC",
"product_ids": [
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information"
}
]
}
RHSA-2020:2479
Vulnerability from csaf_redhat - Published: 2020-06-18 21:12 - Updated: 2025-11-21 18:14Summary
Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update
Notes
Topic
An update for atomic-openshift is now available for Red Hat OpenShift Container Platform 3.11.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.
Security Fix(es):
* libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions (CVE-2017-18367)
* kubernetes: Denial of service in API server via crafted YAML payloads by authorized users (CVE-2019-11254)
* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for atomic-openshift is now available for Red Hat OpenShift Container Platform 3.11.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "OpenShift Enterprise by Red Hat is the company\u0027s cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments. \n\nSecurity Fix(es):\n\n* libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions (CVE-2017-18367)\n\n* kubernetes: Denial of service in API server via crafted YAML payloads by authorized users (CVE-2019-11254)\n\n* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2479",
"url": "https://access.redhat.com/errata/RHSA-2020:2479"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1706826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706826"
},
{
"category": "external",
"summary": "1819486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819486"
},
{
"category": "external",
"summary": "1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2479.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update",
"tracking": {
"current_release_date": "2025-11-21T18:14:47+00:00",
"generator": {
"date": "2025-11-21T18:14:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2020:2479",
"initial_release_date": "2020-06-18T21:12:56+00:00",
"revision_history": [
{
"date": "2020-06-18T21:12:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-06-18T21:12:56+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T18:14:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 3.11",
"product": {
"name": "Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:3.11::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-clients@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-hyperkube@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-hypershift@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-master@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-node@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-pod@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-template-service-broker@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-tests@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-clients@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-clients-redistributable@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-hyperkube@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-hypershift@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-master@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-node@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-pod@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-template-service-broker@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-tests@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"product": {
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"product_id": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift@3.11.232-1.git.0.a5bc32f.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"product": {
"name": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"product_id": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-docker-excluder@3.11.232-1.git.0.a5bc32f.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"product": {
"name": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"product_id": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-excluder@3.11.232-1.git.0.a5bc32f.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src"
},
"product_reference": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch"
},
"product_reference": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch"
},
"product_reference": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-18367",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2019-04-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1706826"
}
],
"notes": [
{
"category": "description",
"text": "libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue may affect OpenShift Container Platform 3.x and 4.x if you are providing a custom Seccomp profile using Security Context Constraints [1]. The custom Seccomp profile would need to specify multiple arguments, such as below, from [2].\n\n{\n \"names\": [\n \"socketcall\"\n ],\n \"action\": \"SCMP_ACT_ALLOW\",\n \"args\": [\n {\n \"index\": 0,\n \"value\": 1,\n \"valueTwo\": 0,\n \"op\": \"SCMP_CMP_EQ\"\n },\n {\n \"index\": 1,\n \"value\": 1,\n \"valueTwo\": 0,\n \"op\": \"SCMP_CMP_EQ\"\n }\n ],\n \"comment\": \"\",\n \"includes\": {},\n \"excludes\": {}\n},\n\nIf such a profile was used the arguments could be combined as an OR rule, not AND, as the user might expect from Seccomp.\n\n[1] https://docs.openshift.com/container-platform/4.1/authentication/managing-security-context-constraints.html\n\n[2] https://github.com/moby/moby/issues/32714#issuecomment-295532163",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-18367"
},
{
"category": "external",
"summary": "RHBZ#1706826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706826"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-18367",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18367"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-18367",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18367"
}
],
"release_date": "2019-04-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-18T21:12:56+00:00",
"details": "See the following documentation, which will be updated shortly for release\n3.11.232, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.",
"product_ids": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2479"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions"
},
{
"cve": "CVE-2019-11254",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2020-04-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1819486"
}
],
"notes": [
{
"category": "description",
"text": "The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Denial of service in API server via crafted YAML payloads by authorized users",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The upstream Kubernetes fix for this vulnerability is to update the version of the Go dependency, gopkg.in/yaml.v2. This issue affects OpenShift Container Platform components that use versions before 2.2.8 of gopkg.in/yaml.v2 and accept YAML payloads.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-11254"
},
{
"category": "external",
"summary": "RHBZ#1819486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819486"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-11254",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11254"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11254",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11254"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc"
}
],
"release_date": "2020-03-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-18T21:12:56+00:00",
"details": "See the following documentation, which will be updated shortly for release\n3.11.232, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.",
"product_ids": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2479"
},
{
"category": "workaround",
"details": "Prevent unauthenticated or unauthorized access to the API server",
"product_ids": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Denial of service in API server via crafted YAML payloads by authorized users"
},
{
"acknowledgments": [
{
"names": [
"the Kubernetes Product Security Committee"
]
},
{
"names": [
"Brice Augras"
],
"organization": "Groupe-Asten",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Christophe Hauquiert"
],
"organization": "Nokia",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-8555",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-04-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1821583"
}
],
"notes": [
{
"category": "description",
"text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "RHBZ#1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30"
}
],
"release_date": "2020-06-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-18T21:12:56+00:00",
"details": "See the following documentation, which will be updated shortly for release\n3.11.232, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.",
"product_ids": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2479"
},
{
"category": "workaround",
"details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC",
"product_ids": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information"
}
]
}
RHSA-2020:2441
Vulnerability from csaf_redhat - Published: 2020-06-17 20:15 - Updated: 2025-11-21 18:14Summary
Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift-enterprise-hyperkube-container security update
Notes
Topic
An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.3.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: A server side request forgery (SSRF) in the kube-controller-manager allows certain authorized users to leak up to 500 bytes of arbitrary information from the master's host network (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.3.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: A server side request forgery (SSRF) in the kube-controller-manager allows certain authorized users to leak up to 500 bytes of arbitrary information from the master\u0027s host network (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2441",
"url": "https://access.redhat.com/errata/RHSA-2020:2441"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2441.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift-enterprise-hyperkube-container security update",
"tracking": {
"current_release_date": "2025-11-21T18:14:44+00:00",
"generator": {
"date": "2025-11-21T18:14:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2020:2441",
"initial_release_date": "2020-06-17T20:15:20+00:00",
"revision_history": [
{
"date": "2020-06-17T20:15:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-06-17T20:15:20+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T18:14:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.3",
"product": {
"name": "Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.3::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64",
"product": {
"name": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64",
"product_id": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64",
"product_identification_helper": {
"purl": "pkg:oci/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.3.25-202006081335"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"product": {
"name": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"product_id": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1?arch=s390x\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.3.25-202006081335"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"product": {
"name": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"product_id": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.3.25-202006081335"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le"
},
"product_reference": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x"
},
"product_reference": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64 as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64"
},
"product_reference": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Kubernetes Product Security Committee"
]
},
{
"names": [
"Brice Augras"
],
"organization": "Groupe-Asten",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Christophe Hauquiert"
],
"organization": "Nokia",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-8555",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-04-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1821583"
}
],
"notes": [
{
"category": "description",
"text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "RHBZ#1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30"
}
],
"release_date": "2020-06-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-17T20:15:20+00:00",
"details": "For OpenShift Container Platform 4.3 see the following documentation, which\nwill be updated shortly for release 4.3.25, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.",
"product_ids": [
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2441"
},
{
"category": "workaround",
"details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC",
"product_ids": [
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information"
}
]
}
RHSA-2020:2448
Vulnerability from csaf_redhat - Published: 2020-06-17 20:17 - Updated: 2025-11-21 18:14Summary
Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift security update
Notes
Topic
An update for openshift is now available for Red Hat OpenShift Container Platform 4.4.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for openshift is now available for Red Hat OpenShift Container Platform 4.4.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2448",
"url": "https://access.redhat.com/errata/RHSA-2020:2448"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2448.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift security update",
"tracking": {
"current_release_date": "2025-11-21T18:14:45+00:00",
"generator": {
"date": "2025-11-21T18:14:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2020:2448",
"initial_release_date": "2020-06-17T20:17:45+00:00",
"revision_history": [
{
"date": "2020-06-17T20:17:45+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-06-17T20:17:45+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T18:14:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.4",
"product": {
"name": "Red Hat OpenShift Container Platform 4.4",
"product_id": "8Base-RHOSE-4.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.4::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.4",
"product": {
"name": "Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.4::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"product": {
"name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"product_id": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift@4.4.0-202006061254.git.1.dc84fb4.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"product": {
"name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"product_id": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift@4.4.0-202006061254.git.1.dc84fb4.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64",
"product": {
"name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64",
"product_id": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.4.0-202006061254.git.1.dc84fb4.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"product": {
"name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"product_id": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.4.0-202006061254.git.1.dc84fb4.el7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src"
},
"product_reference": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64"
},
"product_reference": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src"
},
"product_reference": "openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"relates_to_product_reference": "8Base-RHOSE-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64"
},
"product_reference": "openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64",
"relates_to_product_reference": "8Base-RHOSE-4.4"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Kubernetes Product Security Committee"
]
},
{
"names": [
"Brice Augras"
],
"organization": "Groupe-Asten",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Christophe Hauquiert"
],
"organization": "Nokia",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-8555",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-04-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1821583"
}
],
"notes": [
{
"category": "description",
"text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "RHBZ#1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30"
}
],
"release_date": "2020-06-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-17T20:17:45+00:00",
"details": "For OpenShift Container Platform 4.4 see the following documentation, which\nwill be updated shortly for release 4.4.8, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.",
"product_ids": [
"7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2448"
},
{
"category": "workaround",
"details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC",
"product_ids": [
"7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el7.src",
"7Server-RH7-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el7.x86_64",
"8Base-RHOSE-4.4:openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8.src",
"8Base-RHOSE-4.4:openshift-hyperkube-0:4.4.0-202006061254.git.1.dc84fb4.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information"
}
]
}
RHSA-2020:2440
Vulnerability from csaf_redhat - Published: 2020-06-17 19:44 - Updated: 2025-11-21 18:14Summary
Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift security update
Notes
Topic
An update for openshift is now available for Red Hat OpenShift Container Platform 4.3.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: A server side request forgery (SSRF) in the kube-controller-manager allows certain authorized users to leak up to 500 bytes of arbitrary information from the master's host network (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for openshift is now available for Red Hat OpenShift Container Platform 4.3.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: A server side request forgery (SSRF) in the kube-controller-manager allows certain authorized users to leak up to 500 bytes of arbitrary information from the master\u0027s host network (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2440",
"url": "https://access.redhat.com/errata/RHSA-2020:2440"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2440.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift security update",
"tracking": {
"current_release_date": "2025-11-21T18:14:44+00:00",
"generator": {
"date": "2025-11-21T18:14:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2020:2440",
"initial_release_date": "2020-06-17T19:44:13+00:00",
"revision_history": [
{
"date": "2020-06-17T19:44:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-06-17T19:44:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T18:14:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.3",
"product": {
"name": "Red Hat OpenShift Container Platform 4.3",
"product_id": "8Base-RHOSE-4.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.3::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.3",
"product": {
"name": "Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.3::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"product": {
"name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"product_id": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift@4.3.25-202006060952.git.1.96c30f6.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"product": {
"name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"product_id": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift@4.3.25-202006060952.git.1.96c30f6.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"product": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"product": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el7?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"product": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"product": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el7?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64",
"product": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64",
"product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"product": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"product_id": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-hyperkube@4.3.25-202006060952.git.1.96c30f6.el7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src"
},
"product_reference": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le"
},
"product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x"
},
"product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64"
},
"product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src"
},
"product_reference": "openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"relates_to_product_reference": "8Base-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le"
},
"product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"relates_to_product_reference": "8Base-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x"
},
"product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"relates_to_product_reference": "8Base-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64"
},
"product_reference": "openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64",
"relates_to_product_reference": "8Base-RHOSE-4.3"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Kubernetes Product Security Committee"
]
},
{
"names": [
"Brice Augras"
],
"organization": "Groupe-Asten",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Christophe Hauquiert"
],
"organization": "Nokia",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-8555",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-04-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1821583"
}
],
"notes": [
{
"category": "description",
"text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "RHBZ#1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30"
}
],
"release_date": "2020-06-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-17T19:44:13+00:00",
"details": "For OpenShift Container Platform 4.3 see the following documentation, which\nwill be updated shortly for release 4.3.25, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.",
"product_ids": [
"7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2440"
},
{
"category": "workaround",
"details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC",
"product_ids": [
"7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el7.src",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.ppc64le",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.s390x",
"7Server-RH7-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el7.x86_64",
"8Base-RHOSE-4.3:openshift-0:4.3.25-202006060952.git.1.96c30f6.el8.src",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.ppc64le",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.s390x",
"8Base-RHOSE-4.3:openshift-hyperkube-0:4.3.25-202006060952.git.1.96c30f6.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information"
}
]
}
RHSA-2020_2441
Vulnerability from csaf_redhat - Published: 2020-06-17 20:15 - Updated: 2024-11-22 15:21Summary
Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift-enterprise-hyperkube-container security update
Notes
Topic
An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.3.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: A server side request forgery (SSRF) in the kube-controller-manager allows certain authorized users to leak up to 500 bytes of arbitrary information from the master's host network (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.3.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: A server side request forgery (SSRF) in the kube-controller-manager allows certain authorized users to leak up to 500 bytes of arbitrary information from the master\u0027s host network (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2441",
"url": "https://access.redhat.com/errata/RHSA-2020:2441"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2441.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift-enterprise-hyperkube-container security update",
"tracking": {
"current_release_date": "2024-11-22T15:21:37+00:00",
"generator": {
"date": "2024-11-22T15:21:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2020:2441",
"initial_release_date": "2020-06-17T20:15:20+00:00",
"revision_history": [
{
"date": "2020-06-17T20:15:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-06-17T20:15:20+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:21:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.3",
"product": {
"name": "Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.3::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64",
"product": {
"name": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64",
"product_id": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64",
"product_identification_helper": {
"purl": "pkg:oci/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.3.25-202006081335"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"product": {
"name": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"product_id": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1?arch=s390x\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.3.25-202006081335"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"product": {
"name": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"product_id": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.3.25-202006081335"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le"
},
"product_reference": "openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x"
},
"product_reference": "openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64 as a component of Red Hat OpenShift Container Platform 4.3",
"product_id": "7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64"
},
"product_reference": "openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.3"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Kubernetes Product Security Committee"
]
},
{
"names": [
"Brice Augras"
],
"organization": "Groupe-Asten",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Christophe Hauquiert"
],
"organization": "Nokia",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-8555",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-04-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1821583"
}
],
"notes": [
{
"category": "description",
"text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "RHBZ#1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30"
}
],
"release_date": "2020-06-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-17T20:15:20+00:00",
"details": "For OpenShift Container Platform 4.3 see the following documentation, which\nwill be updated shortly for release 4.3.25, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.",
"product_ids": [
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2441"
},
{
"category": "workaround",
"details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC",
"product_ids": [
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:2d8d0beae7c6ac6eea010224d3df5b32477a1ba87ee345745698a0fcd3a7cc83_ppc64le",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:50eb07078ebeb62e620e64c871803776dd665decc0b5ad5be4e39a6caf97e9e1_s390x",
"7Server-RH7-RHOSE-4.3:openshift4/ose-hyperkube@sha256:d196b0a4f412f63720e360957433b6daf48c88f6f23796f81443e01f86218a19_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information"
}
]
}
RHSA-2020_2479
Vulnerability from csaf_redhat - Published: 2020-06-18 21:12 - Updated: 2024-11-22 15:22Summary
Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update
Notes
Topic
An update for atomic-openshift is now available for Red Hat OpenShift Container Platform 3.11.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.
Security Fix(es):
* libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions (CVE-2017-18367)
* kubernetes: Denial of service in API server via crafted YAML payloads by authorized users (CVE-2019-11254)
* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for atomic-openshift is now available for Red Hat OpenShift Container Platform 3.11.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "OpenShift Enterprise by Red Hat is the company\u0027s cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments. \n\nSecurity Fix(es):\n\n* libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions (CVE-2017-18367)\n\n* kubernetes: Denial of service in API server via crafted YAML payloads by authorized users (CVE-2019-11254)\n\n* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2479",
"url": "https://access.redhat.com/errata/RHSA-2020:2479"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1706826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706826"
},
{
"category": "external",
"summary": "1819486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819486"
},
{
"category": "external",
"summary": "1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2479.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update",
"tracking": {
"current_release_date": "2024-11-22T15:22:02+00:00",
"generator": {
"date": "2024-11-22T15:22:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2020:2479",
"initial_release_date": "2020-06-18T21:12:56+00:00",
"revision_history": [
{
"date": "2020-06-18T21:12:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-06-18T21:12:56+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:22:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 3.11",
"product": {
"name": "Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:3.11::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-clients@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-hyperkube@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-hypershift@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-master@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-node@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-pod@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-template-service-broker@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product": {
"name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_id": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-tests@3.11.232-1.git.0.a5bc32f.el7?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-clients@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-clients-redistributable@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-hyperkube@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-hypershift@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-master@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-node@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-pod@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-template-service-broker@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product": {
"name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_id": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-tests@3.11.232-1.git.0.a5bc32f.el7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"product": {
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"product_id": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift@3.11.232-1.git.0.a5bc32f.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"product": {
"name": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"product_id": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-docker-excluder@3.11.232-1.git.0.a5bc32f.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"product": {
"name": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"product_id": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/atomic-openshift-excluder@3.11.232-1.git.0.a5bc32f.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src"
},
"product_reference": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch"
},
"product_reference": "atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch"
},
"product_reference": "atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le"
},
"product_reference": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11",
"product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
},
"product_reference": "atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-18367",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2019-04-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1706826"
}
],
"notes": [
{
"category": "description",
"text": "libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue may affect OpenShift Container Platform 3.x and 4.x if you are providing a custom Seccomp profile using Security Context Constraints [1]. The custom Seccomp profile would need to specify multiple arguments, such as below, from [2].\n\n{\n \"names\": [\n \"socketcall\"\n ],\n \"action\": \"SCMP_ACT_ALLOW\",\n \"args\": [\n {\n \"index\": 0,\n \"value\": 1,\n \"valueTwo\": 0,\n \"op\": \"SCMP_CMP_EQ\"\n },\n {\n \"index\": 1,\n \"value\": 1,\n \"valueTwo\": 0,\n \"op\": \"SCMP_CMP_EQ\"\n }\n ],\n \"comment\": \"\",\n \"includes\": {},\n \"excludes\": {}\n},\n\nIf such a profile was used the arguments could be combined as an OR rule, not AND, as the user might expect from Seccomp.\n\n[1] https://docs.openshift.com/container-platform/4.1/authentication/managing-security-context-constraints.html\n\n[2] https://github.com/moby/moby/issues/32714#issuecomment-295532163",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-18367"
},
{
"category": "external",
"summary": "RHBZ#1706826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706826"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-18367",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18367"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-18367",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18367"
}
],
"release_date": "2019-04-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-18T21:12:56+00:00",
"details": "See the following documentation, which will be updated shortly for release\n3.11.232, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.",
"product_ids": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2479"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions"
},
{
"cve": "CVE-2019-11254",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2020-04-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1819486"
}
],
"notes": [
{
"category": "description",
"text": "The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Denial of service in API server via crafted YAML payloads by authorized users",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The upstream Kubernetes fix for this vulnerability is to update the version of the Go dependency, gopkg.in/yaml.v2. This issue affects OpenShift Container Platform components that use versions before 2.2.8 of gopkg.in/yaml.v2 and accept YAML payloads.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-11254"
},
{
"category": "external",
"summary": "RHBZ#1819486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819486"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-11254",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11254"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11254",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11254"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc"
}
],
"release_date": "2020-03-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-18T21:12:56+00:00",
"details": "See the following documentation, which will be updated shortly for release\n3.11.232, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.",
"product_ids": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2479"
},
{
"category": "workaround",
"details": "Prevent unauthenticated or unauthorized access to the API server",
"product_ids": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Denial of service in API server via crafted YAML payloads by authorized users"
},
{
"acknowledgments": [
{
"names": [
"the Kubernetes Product Security Committee"
]
},
{
"names": [
"Brice Augras"
],
"organization": "Groupe-Asten",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Christophe Hauquiert"
],
"organization": "Nokia",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-8555",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-04-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1821583"
}
],
"notes": [
{
"category": "description",
"text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "RHBZ#1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30"
}
],
"release_date": "2020-06-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-18T21:12:56+00:00",
"details": "See the following documentation, which will be updated shortly for release\n3.11.232, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.",
"product_ids": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2479"
},
{
"category": "workaround",
"details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC",
"product_ids": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src",
"7Server-RH7-RHOSE-3.11:atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le",
"7Server-RH7-RHOSE-3.11:atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information"
}
]
}
RHSA-2020:2449
Vulnerability from csaf_redhat - Published: 2020-06-17 21:28 - Updated: 2025-11-21 18:14Summary
Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift-enterprise-hyperkube-container security update
Notes
Topic
An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.4.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.4.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2449",
"url": "https://access.redhat.com/errata/RHSA-2020:2449"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2449.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift-enterprise-hyperkube-container security update",
"tracking": {
"current_release_date": "2025-11-21T18:14:45+00:00",
"generator": {
"date": "2025-11-21T18:14:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2020:2449",
"initial_release_date": "2020-06-17T21:28:57+00:00",
"revision_history": [
{
"date": "2020-06-17T21:28:57+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-06-17T21:28:57+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T18:14:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.4",
"product": {
"name": "Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.4::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64",
"product": {
"name": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64",
"product_id": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.4.0-202006080610"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"product": {
"name": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"product_id": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"product_identification_helper": {
"purl": "pkg:oci/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd?arch=s390x\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.4.0-202006080610"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"product": {
"name": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"product_id": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.4.0-202006080610"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x"
},
"product_reference": "openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le"
},
"product_reference": "openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64 as a component of Red Hat OpenShift Container Platform 4.4",
"product_id": "7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64"
},
"product_reference": "openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64",
"relates_to_product_reference": "7Server-RH7-RHOSE-4.4"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Kubernetes Product Security Committee"
]
},
{
"names": [
"Brice Augras"
],
"organization": "Groupe-Asten",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Christophe Hauquiert"
],
"organization": "Nokia",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-8555",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-04-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1821583"
}
],
"notes": [
{
"category": "description",
"text": "A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master\u0027s host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data.\n\nThe version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low.\n\nRed Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "RHBZ#1821583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821583"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30"
}
],
"release_date": "2020-06-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-06-17T21:28:57+00:00",
"details": "For OpenShift Container Platform 4.4 see the following documentation, which\nwill be updated shortly for release 4.4.8, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.",
"product_ids": [
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2449"
},
{
"category": "workaround",
"details": "Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC",
"product_ids": [
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:1654cacf069e4ce3ab874df3a90d6e93e6b8ead14e24924bf5115c143d566bcd_s390x",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:200044e6cdf56f067c1aaace4fde3215593e3e3152ff8600527077d35adc8d4e_ppc64le",
"7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:ec018bd232f6555bd7ce9e1c63cf4b19c95576c40e9868f2b9eb3127d61180e1_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information"
}
]
}
CNVD-2020-31521
Vulnerability from cnvd - Published: 2020-06-04
VLAI Severity ?
Title
Google Kubernetes跨站请求伪造漏洞
Description
Google Kubernetes是美国谷歌（Google）公司的一套开源的Docker容器集群管理系统。该系统为容器化的应用提供资源调度、部署运行、服务发现和扩容缩容等功能。
Google Kubernetes中的kube-controller-manager存在安全漏洞。该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。远程攻击者可以利用此漏洞进行SSRF攻击，从未受保护的端点泄漏泄露多达500字节的任意信息。
Severity
低
Patch Name
Google Kubernetes跨站请求伪造漏洞的补丁
Patch Description
Google Kubernetes是美国谷歌（Google）公司的一套开源的Docker容器集群管理系统。该系统为容器化的应用提供资源调度、部署运行、服务发现和扩容缩容等功能。
Google Kubernetes中的kube-controller-manager存在安全漏洞。该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。远程攻击者可以利用此漏洞进行SSRF攻击，从未受保护的端点泄漏泄露多达500字节的任意信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/kubernetes/kubernetes/issues/91542
Reference
https://access.redhat.com/security/cve/cve-2020-8555
Impacted products
| Name | Google Kubernetes |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2020-8555"
}
},
"description": "Google Kubernetes\u662f\u7f8e\u56fd\u8c37\u6b4c\uff08Google\uff09\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684Docker\u5bb9\u5668\u96c6\u7fa4\u7ba1\u7406\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u4e3a\u5bb9\u5668\u5316\u7684\u5e94\u7528\u63d0\u4f9b\u8d44\u6e90\u8c03\u5ea6\u3001\u90e8\u7f72\u8fd0\u884c\u3001\u670d\u52a1\u53d1\u73b0\u548c\u6269\u5bb9\u7f29\u5bb9\u7b49\u529f\u80fd\u3002\n\nGoogle Kubernetes\u4e2d\u7684kube-controller-manager\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u7684\u4ee3\u7801\u5f00\u53d1\u8fc7\u7a0b\u4e2d\u5b58\u5728\u8bbe\u8ba1\u6216\u5b9e\u73b0\u4e0d\u5f53\u7684\u95ee\u9898\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6b64\u6f0f\u6d1e\u8fdb\u884cSSRF\u653b\u51fb\uff0c\u4ece\u672a\u53d7\u4fdd\u62a4\u7684\u7aef\u70b9\u6cc4\u6f0f\u6cc4\u9732\u591a\u8fbe500\u5b57\u8282\u7684\u4efb\u610f\u4fe1\u606f\u3002",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/kubernetes/kubernetes/issues/91542",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2020-31521",
"openTime": "2020-06-04",
"patchDescription": "Google Kubernetes\u662f\u7f8e\u56fd\u8c37\u6b4c\uff08Google\uff09\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684Docker\u5bb9\u5668\u96c6\u7fa4\u7ba1\u7406\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u4e3a\u5bb9\u5668\u5316\u7684\u5e94\u7528\u63d0\u4f9b\u8d44\u6e90\u8c03\u5ea6\u3001\u90e8\u7f72\u8fd0\u884c\u3001\u670d\u52a1\u53d1\u73b0\u548c\u6269\u5bb9\u7f29\u5bb9\u7b49\u529f\u80fd\u3002\r\n\r\nGoogle Kubernetes\u4e2d\u7684kube-controller-manager\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u7684\u4ee3\u7801\u5f00\u53d1\u8fc7\u7a0b\u4e2d\u5b58\u5728\u8bbe\u8ba1\u6216\u5b9e\u73b0\u4e0d\u5f53\u7684\u95ee\u9898\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6b64\u6f0f\u6d1e\u8fdb\u884cSSRF\u653b\u51fb\uff0c\u4ece\u672a\u53d7\u4fdd\u62a4\u7684\u7aef\u70b9\u6cc4\u6f0f\u6cc4\u9732\u591a\u8fbe500\u5b57\u8282\u7684\u4efb\u610f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Google Kubernetes\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "Google Kubernetes"
},
"referenceLink": "https://access.redhat.com/security/cve/cve-2020-8555",
"serverity": "\u4f4e",
"submitTime": "2020-06-03",
"title": "Google Kubernetes\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e"
}
GSD-2020-8555
Vulnerability from gsd - Updated: 2023-12-13 01:21Details
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-8555",
"description": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).",
"id": "GSD-2020-8555",
"references": [
"https://www.suse.com/security/cve/CVE-2020-8555.html",
"https://access.redhat.com/errata/RHSA-2020:2594",
"https://access.redhat.com/errata/RHSA-2020:2479",
"https://access.redhat.com/errata/RHSA-2020:2449",
"https://access.redhat.com/errata/RHSA-2020:2448",
"https://access.redhat.com/errata/RHSA-2020:2441",
"https://access.redhat.com/errata/RHSA-2020:2440",
"https://linux.oracle.com/cve/CVE-2020-8555.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-8555"
],
"details": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).",
"id": "GSD-2020-8555",
"modified": "2023-12-13T01:21:53.665168Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"AKA": "",
"ASSIGNER": "security@kubernetes.io",
"DATE_PUBLIC": "",
"ID": "CVE-2020-8555",
"STATE": "PUBLIC",
"TITLE": "Kubernetes kube-controller-manager SSRF"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Kubernetes",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "\u003c",
"version_name": "1.15",
"version_value": "1.15.12"
},
{
"platform": "",
"version_affected": "\u003c",
"version_name": "1.16",
"version_value": "1.16.9"
},
{
"platform": "",
"version_affected": "\u003c",
"version_name": "1.17",
"version_value": "1.17.5"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.18.0"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.1"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.2"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.3"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.4"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.5"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.6"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.7"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.8"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.9"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.10"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.11"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.12"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.13"
},
{
"platform": "",
"version_affected": "",
"version_name": "",
"version_value": "1.14"
}
]
}
}
]
},
"vendor_name": "Kubernetes"
}
]
}
},
"configuration": [],
"credit": [
{
"lang": "eng",
"value": "Brice Augras from Groupe-Asten and Christophe Hauquiert from Nokia"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services)."
}
]
},
"exploit": [],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-918 Server-Side Request Forgery (SSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20200601 CVE-2020-8555: Kubernetes: Half-Blind SSRF in kube-controller-manager",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2020/06/01/4"
},
{
"name": "",
"refsource": "MLIST",
"url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion"
},
{
"name": "https://github.com/kubernetes/kubernetes/issues/91542",
"refsource": "CONFIRM",
"url": "https://github.com/kubernetes/kubernetes/issues/91542"
},
{
"name": "FEDORA-2020-aeea04cd13",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200724-0005/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200724-0005/"
},
{
"name": "[oss-security] 20210504 [kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2021/05/04/8"
}
]
},
"solution": [],
"source": {
"advisory": "",
"defect": [
"https://github.com/kubernetes/kubernetes/issues/91542"
],
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "eng",
"value": "Prior to upgrading, this vulnerability can be mitigated by adding endpoint protections on the master or restricting usage of the vulnerable volume types (for example by constraining usage with a PodSecurityPolicy or third-party admission controller such as Gatekeeper) and restricting StorageClass write permissions through RBAC."
}
]
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003cv1.15.11 || \u003e=v1.16.0 \u003cv1.16.9 || \u003e=v1.17.0 \u003cv1.17.5 || =v1.18.0",
"affected_versions": "All versions before 1.15.11, all versions starting from 1.16.0 before 1.16.9, all versions starting from 1.17.0 before 1.17.5, version 1.18.0",
"cvss_v2": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-918",
"CWE-937"
],
"date": "2021-05-04",
"description": "The Kubernetes kube-controller-manager is vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).",
"fixed_versions": [
"v1.15.11",
"v1.16.9",
"v1.17.5",
"v1.18.1-beta.0"
],
"identifier": "CVE-2020-8555",
"identifiers": [
"CVE-2020-8555"
],
"not_impacted": "All versions starting from 1.15.11 before 1.16.0, all versions starting from 1.16.9 before 1.17.0, all versions starting from 1.17.5 before 1.18.0, all versions after 1.18.0",
"package_slug": "go/github.com/kubernetes/kubernetes",
"pubdate": "2020-06-05",
"solution": "Upgrade to versions 1.15.11, 1.16.9, 1.17.5, 1.18.1-beta.0 or above. *Note*: 1.18.1-beta.0 may be an unstable version. Use caution.",
"title": "Server-Side Request Forgery (SSRF)",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
],
"uuid": "49421dfe-0e2d-413e-b572-b20d7a119e7a",
"versions": [
{
"commit": {
"sha": "38d05c7c415152c9249ad0c553cbbcb86f247a68",
"tags": [
"v1.16.0"
],
"timestamp": "20190913145653"
},
"number": "v1.16.0"
},
{
"commit": {
"sha": "02a9c9f39a18ee40c37835c36c7c80e0797b0d85",
"tags": [
"v1.17.0"
],
"timestamp": "20191206012503"
},
"number": "v1.17.0"
},
{
"commit": {
"sha": "bc19501317000efb086595adb9ad5f3627a6d95a",
"tags": [
"v1.15.11"
],
"timestamp": "20200312205918"
},
"number": "v1.15.11"
},
{
"commit": {
"sha": "6ac870f868255d1d40ce3ac115b62f8d5e02e8a3",
"tags": [
"v1.18.1-beta.0"
],
"timestamp": "20200325144952"
},
"number": "v1.18.1-beta.0"
},
{
"commit": {
"sha": "f6cc41b23ef90243e9dbba5fbad501630caaa737",
"tags": [
"v1.18.0"
],
"timestamp": "20200325144952"
},
"number": "v1.18.0"
},
{
"commit": {
"sha": "270e315bf98d867a302bec5c1d0b9ed045708bf2",
"tags": [
"v1.17.5"
],
"timestamp": "20200416113457"
},
"number": "v1.17.5"
},
{
"commit": {
"sha": "9c4650b12ad33a2a41b0f474ec11c2bf1371658e",
"tags": [
"v1.16.9"
],
"timestamp": "20200416113528"
},
"number": "v1.16.9"
}
]
},
{
"affected_range": "\u003e=1.18.0 \u003c1.18.1||\u003e=1.17.0 \u003c1.17.4||\u003e=1.16.0 \u003c1.16.9||\u003c1.15.12",
"affected_versions": "All versions starting from 1.18.0 before 1.18.1, all versions starting from 1.17.0 before 1.17.4, all versions starting from 1.16.0 before 1.16.9, all versions before 1.15.12",
"cvss_v2": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-918",
"CWE-937"
],
"date": "2022-04-12",
"description": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 is vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).",
"fixed_versions": [
"1.18.1",
"1.18.1",
"1.16.9",
"1.15.12",
"1.15.12"
],
"identifier": "CVE-2020-8555",
"identifiers": [
"GHSA-x6mj-w4jf-jmgw",
"CVE-2020-8555"
],
"not_impacted": "All versions before 1.18.0, all versions starting from 1.18.1, all versions before 1.17.0, all versions starting from 1.17.4, all versions before 1.16.0, all versions starting from 1.15.12 before 1.16.9",
"package_slug": "go/github.com/kubernetes/kubernetes/pkg/volume/storageos",
"pubdate": "2022-02-15",
"solution": "Upgrade to versions 1.18.1, 1.18.1, 1.16.9, 1.15.12, 1.15.12 or above.",
"title": "Server-Side Request Forgery (SSRF)",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-8555",
"https://github.com/kubernetes/kubernetes/issues/91542",
"https://github.com/kubernetes/kubernetes/pull/89794",
"https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/",
"https://security.netapp.com/advisory/ntap-20200724-0005/",
"http://www.openwall.com/lists/oss-security/2020/06/01/4",
"http://www.openwall.com/lists/oss-security/2021/05/04/8",
"https://github.com/advisories/GHSA-x6mj-w4jf-jmgw"
],
"uuid": "0df79936-304b-41b2-8141-a19199f9ddd8"
},
{
"affected_range": "\u003c1.15.11||\u003e=1.16.0 \u003c1.16.9||\u003e=1.17.0 \u003c1.17.5||\u003e=1.18.0 \u003c1.18.1",
"affected_versions": "All versions before 1.15.11, all versions starting from 1.16.0 before 1.16.9, all versions starting from 1.17.0 before 1.17.5, version 1.18.0",
"cvss_v2": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-918",
"CWE-937"
],
"date": "2021-05-04",
"description": "The Kubernetes kube-controller-manager is vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).",
"fixed_versions": [
"1.15.11",
"1.16.9",
"1.17.5",
"1.18.1"
],
"identifier": "CVE-2020-8555",
"identifiers": [
"CVE-2020-8555"
],
"not_impacted": "All versions starting from 1.15.11 before 1.16.0, all versions starting from 1.17.5 before 1.18.0, all versions starting from 1.18.1",
"package_slug": "go/k8s.io/kubernetes/pkg/apis/apps/validation",
"pubdate": "2020-06-05",
"solution": "Upgrade to version 1.15.11, 1.16.9, 1.17.5, 1.18.1 or above.",
"title": "Server-Side Request Forgery (SSRF)",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
],
"uuid": "17a622d8-557c-4209-9a96-aa69e3d747eb"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:1.18.0:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.15.11",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.17.5",
"versionStartIncluding": "1.17.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.16.9",
"versionStartIncluding": "1.16.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security@kubernetes.io",
"ID": "CVE-2020-8555"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "N/A",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion"
},
{
"name": "https://github.com/kubernetes/kubernetes/issues/91542",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/kubernetes/kubernetes/issues/91542"
},
{
"name": "[oss-security] 20200601 CVE-2020-8555: Kubernetes: Half-Blind SSRF in kube-controller-manager",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2020/06/01/4"
},
{
"name": "FEDORA-2020-aeea04cd13",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200724-0005/",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20200724-0005/"
},
{
"name": "[oss-security] 20210504 [kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2021/05/04/8"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 4.0
}
},
"lastModifiedDate": "2022-11-16T03:39Z",
"publishedDate": "2020-06-05T17:15Z"
}
}
}
GHSA-X6MJ-W4JF-JMGW
Vulnerability from github – Published: 2022-02-15 01:57 – Updated: 2023-09-18 22:44
VLAI?
Summary
Server Side Request Forgery (SSRF) in Kubernetes
Details
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Severity ?
6.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "1.18.0"
},
{
"fixed": "1.18.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "1.17.0"
},
{
"fixed": "1.17.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "1.16.0"
},
{
"fixed": "1.16.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.15.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-8555"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-13T20:13:43Z",
"nvd_published_at": "2020-06-05T17:15:00Z",
"severity": "MODERATE"
},
"details": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).",
"id": "GHSA-x6mj-w4jf-jmgw",
"modified": "2023-09-18T22:44:56Z",
"published": "2022-02-15T01:57:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/91542"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/pull/89794"
},
{
"type": "WEB",
"url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200724-0005"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/06/01/4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/05/04/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server Side Request Forgery (SSRF) in Kubernetes"
}
CERTFR-2022-AVI-591
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Spectrum | IBM Spectrum Protect Plus versions antérieures à 10.1.11 | ||
| IBM | Spectrum | IBM Spectrum Protect Client versions antérieures à 8.1.1.15 | ||
| IBM | N/A | IBM® Db2® et Db2 Warehouse® sur Cloud Pak for Data versions antérieures à 4.5.0 | ||
| IBM | Db2 | IBM® Db2® sur Openshift versions antérieures à 11.5.7.0-cn5 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Spectrum Protect Plus versions ant\u00e9rieures \u00e0 10.1.11",
"product": {
"name": "Spectrum",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Spectrum Protect Client versions ant\u00e9rieures \u00e0 8.1.1.15",
"product": {
"name": "Spectrum",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM\u00ae Db2\u00ae et Db2 Warehouse\u00ae sur Cloud Pak for Data versions ant\u00e9rieures \u00e0 4.5.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM\u00ae Db2\u00ae sur Openshift versions ant\u00e9rieures \u00e0 11.5.7.0-cn5",
"product": {
"name": "Db2",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-29368",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-29368"
},
{
"name": "CVE-2021-20322",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20322"
},
{
"name": "CVE-2018-1099",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1099"
},
{
"name": "CVE-2021-4154",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4154"
},
{
"name": "CVE-2021-45485",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45485"
},
{
"name": "CVE-2022-27191",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27191"
},
{
"name": "CVE-2021-30465",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-30465"
},
{
"name": "CVE-2019-11249",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11249"
},
{
"name": "CVE-2020-8557",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8557"
},
{
"name": "CVE-2020-7919",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7919"
},
{
"name": "CVE-2019-11247",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11247"
},
{
"name": "CVE-2020-28851",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28851"
},
{
"name": "CVE-2021-42248",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42248"
},
{
"name": "CVE-2018-1002105",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1002105"
},
{
"name": "CVE-2021-31525",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31525"
},
{
"name": "CVE-2020-15112",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15112"
},
{
"name": "CVE-2021-4203",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4203"
},
{
"name": "CVE-2021-25736",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25736"
},
{
"name": "CVE-2020-27813",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-27813"
},
{
"name": "CVE-2018-17848",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17848"
},
{
"name": "CVE-2019-16884",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16884"
},
{
"name": "CVE-2021-41864",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41864"
},
{
"name": "CVE-2020-36385",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36385"
},
{
"name": "CVE-2020-25704",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25704"
},
{
"name": "CVE-2021-25735",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25735"
},
{
"name": "CVE-2017-18367",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18367"
},
{
"name": "CVE-2020-8564",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8564"
},
{
"name": "CVE-2021-20206",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20206"
},
{
"name": "CVE-2019-11246",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11246"
},
{
"name": "CVE-2021-31916",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31916"
},
{
"name": "CVE-2020-8565",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8565"
},
{
"name": "CVE-2021-27918",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27918"
},
{
"name": "CVE-2021-3635",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3635"
},
{
"name": "CVE-2021-3573",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3573"
},
{
"name": "CVE-2018-1098",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1098"
},
{
"name": "CVE-2021-28971",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28971"
},
{
"name": "CVE-2019-11254",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11254"
},
{
"name": "CVE-2022-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0286"
},
{
"name": "CVE-2021-4002",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4002"
},
{
"name": "CVE-2021-4083",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4083"
},
{
"name": "CVE-2021-45486",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45486"
},
{
"name": "CVE-2020-8551",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8551"
},
{
"name": "CVE-2017-1002101",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-1002101"
},
{
"name": "CVE-2021-4157",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4157"
},
{
"name": "CVE-2020-15106",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15106"
},
{
"name": "CVE-2021-43784",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43784"
},
{
"name": "CVE-2021-20321",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20321"
},
{
"name": "CVE-2018-17142",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17142"
},
{
"name": "CVE-2022-0185",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0185"
},
{
"name": "CVE-2022-0847",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0847"
},
{
"name": "CVE-2021-41190",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41190"
},
{
"name": "CVE-2021-44733",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44733"
},
{
"name": "CVE-2020-8552",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8552"
},
{
"name": "CVE-2021-20269",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20269"
},
{
"name": "CVE-2020-8554",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8554"
},
{
"name": "CVE-2019-11252",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11252"
},
{
"name": "CVE-2021-3121",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3121"
},
{
"name": "CVE-2019-11250",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11250"
},
{
"name": "CVE-2022-22942",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22942"
},
{
"name": "CVE-2022-1011",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1011"
},
{
"name": "CVE-2021-3669",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3669"
},
{
"name": "CVE-2020-8559",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8559"
},
{
"name": "CVE-2020-10752",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10752"
},
{
"name": "CVE-2021-28950",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28950"
},
{
"name": "CVE-2021-29650",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29650"
},
{
"name": "CVE-2020-36322",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36322"
},
{
"name": "CVE-2020-28852",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28852"
},
{
"name": "CVE-2021-4155",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4155"
},
{
"name": "CVE-2020-15113",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15113"
},
{
"name": "CVE-2020-29652",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-29652"
},
{
"name": "CVE-2018-17847",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17847"
},
{
"name": "CVE-2022-0492",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0492"
},
{
"name": "CVE-2020-26160",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26160"
},
{
"name": "CVE-2022-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
},
{
"name": "CVE-2021-42836",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42836"
},
{
"name": "CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"name": "CVE-2021-44716",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44716"
},
{
"name": "CVE-2018-17143",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17143"
},
{
"name": "CVE-2019-11841",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11841"
},
{
"name": "CVE-2018-20699",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20699"
},
{
"name": "CVE-2021-33194",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33194"
},
{
"name": "CVE-2020-14040",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14040"
},
{
"name": "CVE-2021-3764",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3764"
},
{
"name": "CVE-2019-1002101",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1002101"
},
{
"name": "CVE-2021-38201",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38201"
},
{
"name": "CVE-2021-21781",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21781"
},
{
"name": "CVE-2022-0850",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0850"
},
{
"name": "CVE-2021-3538",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3538"
},
{
"name": "CVE-2019-11253",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11253"
},
{
"name": "CVE-2021-25737",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25737"
},
{
"name": "CVE-2018-17846",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17846"
},
{
"name": "CVE-2021-4028",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4028"
},
{
"name": "CVE-2021-43565",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43565"
},
{
"name": "CVE-2021-25741",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25741"
},
{
"name": "CVE-2018-16886",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-16886"
},
{
"name": "CVE-2021-44907",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44907"
},
{
"name": "CVE-2021-4197",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4197"
},
{
"name": "CVE-2020-9283",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-9283"
},
{
"name": "CVE-2019-11840",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11840"
},
{
"name": "CVE-2019-11251",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11251"
},
{
"name": "CVE-2020-36067",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36067"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-591",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-06-30T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire, un d\u00e9ni de service \u00e0 distance et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6596399 du 29 juin 2022",
"url": "https://www.ibm.com/support/pages/node/6596399"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6596971 du 29 juin 2022",
"url": "https://www.ibm.com/support/pages/node/6596971"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6599703 du 29 juin 2022",
"url": "https://www.ibm.com/support/pages/node/6599703"
}
]
}
CERTFR-2022-AVI-591
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Spectrum | IBM Spectrum Protect Plus versions antérieures à 10.1.11 | ||
| IBM | Spectrum | IBM Spectrum Protect Client versions antérieures à 8.1.1.15 | ||
| IBM | N/A | IBM® Db2® et Db2 Warehouse® sur Cloud Pak for Data versions antérieures à 4.5.0 | ||
| IBM | Db2 | IBM® Db2® sur Openshift versions antérieures à 11.5.7.0-cn5 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Spectrum Protect Plus versions ant\u00e9rieures \u00e0 10.1.11",
"product": {
"name": "Spectrum",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Spectrum Protect Client versions ant\u00e9rieures \u00e0 8.1.1.15",
"product": {
"name": "Spectrum",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM\u00ae Db2\u00ae et Db2 Warehouse\u00ae sur Cloud Pak for Data versions ant\u00e9rieures \u00e0 4.5.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM\u00ae Db2\u00ae sur Openshift versions ant\u00e9rieures \u00e0 11.5.7.0-cn5",
"product": {
"name": "Db2",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-29368",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-29368"
},
{
"name": "CVE-2021-20322",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20322"
},
{
"name": "CVE-2018-1099",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1099"
},
{
"name": "CVE-2021-4154",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4154"
},
{
"name": "CVE-2021-45485",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45485"
},
{
"name": "CVE-2022-27191",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27191"
},
{
"name": "CVE-2021-30465",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-30465"
},
{
"name": "CVE-2019-11249",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11249"
},
{
"name": "CVE-2020-8557",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8557"
},
{
"name": "CVE-2020-7919",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7919"
},
{
"name": "CVE-2019-11247",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11247"
},
{
"name": "CVE-2020-28851",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28851"
},
{
"name": "CVE-2021-42248",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42248"
},
{
"name": "CVE-2018-1002105",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1002105"
},
{
"name": "CVE-2021-31525",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31525"
},
{
"name": "CVE-2020-15112",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15112"
},
{
"name": "CVE-2021-4203",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4203"
},
{
"name": "CVE-2021-25736",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25736"
},
{
"name": "CVE-2020-27813",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-27813"
},
{
"name": "CVE-2018-17848",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17848"
},
{
"name": "CVE-2019-16884",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16884"
},
{
"name": "CVE-2021-41864",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41864"
},
{
"name": "CVE-2020-36385",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36385"
},
{
"name": "CVE-2020-25704",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25704"
},
{
"name": "CVE-2021-25735",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25735"
},
{
"name": "CVE-2017-18367",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18367"
},
{
"name": "CVE-2020-8564",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8564"
},
{
"name": "CVE-2021-20206",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20206"
},
{
"name": "CVE-2019-11246",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11246"
},
{
"name": "CVE-2021-31916",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31916"
},
{
"name": "CVE-2020-8565",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8565"
},
{
"name": "CVE-2021-27918",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27918"
},
{
"name": "CVE-2021-3635",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3635"
},
{
"name": "CVE-2021-3573",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3573"
},
{
"name": "CVE-2018-1098",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1098"
},
{
"name": "CVE-2021-28971",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28971"
},
{
"name": "CVE-2019-11254",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11254"
},
{
"name": "CVE-2022-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0286"
},
{
"name": "CVE-2021-4002",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4002"
},
{
"name": "CVE-2021-4083",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4083"
},
{
"name": "CVE-2021-45486",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45486"
},
{
"name": "CVE-2020-8551",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8551"
},
{
"name": "CVE-2017-1002101",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-1002101"
},
{
"name": "CVE-2021-4157",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4157"
},
{
"name": "CVE-2020-15106",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15106"
},
{
"name": "CVE-2021-43784",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43784"
},
{
"name": "CVE-2021-20321",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20321"
},
{
"name": "CVE-2018-17142",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17142"
},
{
"name": "CVE-2022-0185",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0185"
},
{
"name": "CVE-2022-0847",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0847"
},
{
"name": "CVE-2021-41190",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41190"
},
{
"name": "CVE-2021-44733",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44733"
},
{
"name": "CVE-2020-8552",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8552"
},
{
"name": "CVE-2021-20269",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20269"
},
{
"name": "CVE-2020-8554",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8554"
},
{
"name": "CVE-2019-11252",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11252"
},
{
"name": "CVE-2021-3121",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3121"
},
{
"name": "CVE-2019-11250",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11250"
},
{
"name": "CVE-2022-22942",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22942"
},
{
"name": "CVE-2022-1011",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1011"
},
{
"name": "CVE-2021-3669",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3669"
},
{
"name": "CVE-2020-8559",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8559"
},
{
"name": "CVE-2020-10752",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10752"
},
{
"name": "CVE-2021-28950",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28950"
},
{
"name": "CVE-2021-29650",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29650"
},
{
"name": "CVE-2020-36322",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36322"
},
{
"name": "CVE-2020-28852",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28852"
},
{
"name": "CVE-2021-4155",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4155"
},
{
"name": "CVE-2020-15113",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15113"
},
{
"name": "CVE-2020-29652",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-29652"
},
{
"name": "CVE-2018-17847",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17847"
},
{
"name": "CVE-2022-0492",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0492"
},
{
"name": "CVE-2020-26160",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26160"
},
{
"name": "CVE-2022-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
},
{
"name": "CVE-2021-42836",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42836"
},
{
"name": "CVE-2020-8555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8555"
},
{
"name": "CVE-2021-44716",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44716"
},
{
"name": "CVE-2018-17143",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17143"
},
{
"name": "CVE-2019-11841",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11841"
},
{
"name": "CVE-2018-20699",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20699"
},
{
"name": "CVE-2021-33194",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33194"
},
{
"name": "CVE-2020-14040",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14040"
},
{
"name": "CVE-2021-3764",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3764"
},
{
"name": "CVE-2019-1002101",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1002101"
},
{
"name": "CVE-2021-38201",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38201"
},
{
"name": "CVE-2021-21781",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21781"
},
{
"name": "CVE-2022-0850",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0850"
},
{
"name": "CVE-2021-3538",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3538"
},
{
"name": "CVE-2019-11253",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11253"
},
{
"name": "CVE-2021-25737",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25737"
},
{
"name": "CVE-2018-17846",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17846"
},
{
"name": "CVE-2021-4028",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4028"
},
{
"name": "CVE-2021-43565",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43565"
},
{
"name": "CVE-2021-25741",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25741"
},
{
"name": "CVE-2018-16886",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-16886"
},
{
"name": "CVE-2021-44907",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44907"
},
{
"name": "CVE-2021-4197",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4197"
},
{
"name": "CVE-2020-9283",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-9283"
},
{
"name": "CVE-2019-11840",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11840"
},
{
"name": "CVE-2019-11251",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11251"
},
{
"name": "CVE-2020-36067",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36067"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-591",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-06-30T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire, un d\u00e9ni de service \u00e0 distance et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6596399 du 29 juin 2022",
"url": "https://www.ibm.com/support/pages/node/6596399"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6596971 du 29 juin 2022",
"url": "https://www.ibm.com/support/pages/node/6596971"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6599703 du 29 juin 2022",
"url": "https://www.ibm.com/support/pages/node/6599703"
}
]
}
FKIE_CVE-2020-8555
Vulnerability from fkie_nvd - Published: 2020-06-05 17:15 - Updated: 2024-11-21 05:39
Severity ?
6.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
6.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
6.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Summary
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| kubernetes | kubernetes | * | |
| kubernetes | kubernetes | * | |
| kubernetes | kubernetes | * | |
| kubernetes | kubernetes | 1.18.0 | |
| fedoraproject | fedora | 32 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1BB84B14-8D71-4BEA-90FC-DB76F9A0F781",
"versionEndExcluding": "1.15.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"matchCriteriaId": "111CE2DC-82F8-4AF6-99B6-5BB847A18D95",
"versionEndExcluding": "1.16.9",
"versionStartIncluding": "1.16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9D5D5658-D416-434A-BA64-74DA2A4F13E2",
"versionEndExcluding": "1.17.5",
"versionStartIncluding": "1.17.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.18.0:-:*:*:*:*:*:*",
"matchCriteriaId": "AF65B08E-28BD-496F-88AE-CB7271BD7379",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services)."
},
{
"lang": "es",
"value": "El Kubernetes kube-controller-manager en las versiones v1.0-1.14, versiones anteriores a v1.15.12, v1.16.9, v1.17.5 y v1.18.0, son vulnerables a un ataque de tipo Server Side Request Forgery (SSRF) que permite que determinados usuarios autorizados pierdan hasta 500 bytes de informaci\u00f3n arbitraria de endpoints desprotegidos dentro de la red host del maestro (tales como los servicios link-local o loopback)"
}
],
"id": "CVE-2020-8555",
"lastModified": "2024-11-21T05:39:01.533",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 4.0,
"source": "jordan@liggitt.net",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 4.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-05T17:15:11.640",
"references": [
{
"source": "jordan@liggitt.net",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2020/06/01/4"
},
{
"source": "jordan@liggitt.net",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2021/05/04/8"
},
{
"source": "jordan@liggitt.net",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/kubernetes/kubernetes/issues/91542"
},
{
"source": "jordan@liggitt.net",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion"
},
{
"source": "jordan@liggitt.net",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/"
},
{
"source": "jordan@liggitt.net",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20200724-0005/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2020/06/01/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2021/05/04/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/kubernetes/kubernetes/issues/91542"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20200724-0005/"
}
],
"sourceIdentifier": "jordan@liggitt.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "jordan@liggitt.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
OPENSUSE-SU-2025:15424-1
Vulnerability from csaf_opensuse - Published: 2025-08-08 00:00 - Updated: 2025-08-08 00:00Summary
govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media
Notes
Title of the patch
govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media
Description of the patch
These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-15424
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2025-15424",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15424-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7561 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7561/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-9962 page",
"url": "https://www.suse.com/security/cve/CVE-2016-9962/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-1000056 page",
"url": "https://www.suse.com/security/cve/CVE-2017-1000056/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-1002102 page",
"url": "https://www.suse.com/security/cve/CVE-2017-1002102/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1002100 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1002100/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1002101 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1002101/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-16733 page",
"url": "https://www.suse.com/security/cve/CVE-2018-16733/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-19184 page",
"url": "https://www.suse.com/security/cve/CVE-2018-19184/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-1002100 page",
"url": "https://www.suse.com/security/cve/CVE-2019-1002100/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-1002101 page",
"url": "https://www.suse.com/security/cve/CVE-2019-1002101/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-11245 page",
"url": "https://www.suse.com/security/cve/CVE-2019-11245/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-11251 page",
"url": "https://www.suse.com/security/cve/CVE-2019-11251/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-11253 page",
"url": "https://www.suse.com/security/cve/CVE-2019-11253/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-26240 page",
"url": "https://www.suse.com/security/cve/CVE-2020-26240/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-26241 page",
"url": "https://www.suse.com/security/cve/CVE-2020-26241/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-8551 page",
"url": "https://www.suse.com/security/cve/CVE-2020-8551/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-8555 page",
"url": "https://www.suse.com/security/cve/CVE-2020-8555/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-8557 page",
"url": "https://www.suse.com/security/cve/CVE-2020-8557/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-8558 page",
"url": "https://www.suse.com/security/cve/CVE-2020-8558/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-8562 page",
"url": "https://www.suse.com/security/cve/CVE-2020-8562/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-8563 page",
"url": "https://www.suse.com/security/cve/CVE-2020-8563/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-8566 page",
"url": "https://www.suse.com/security/cve/CVE-2020-8566/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-25735 page",
"url": "https://www.suse.com/security/cve/CVE-2021-25735/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-25736 page",
"url": "https://www.suse.com/security/cve/CVE-2021-25736/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-25737 page",
"url": "https://www.suse.com/security/cve/CVE-2021-25737/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-25741 page",
"url": "https://www.suse.com/security/cve/CVE-2021-25741/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-25743 page",
"url": "https://www.suse.com/security/cve/CVE-2021-25743/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-30465 page",
"url": "https://www.suse.com/security/cve/CVE-2021-30465/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-29162 page",
"url": "https://www.suse.com/security/cve/CVE-2022-29162/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-29177 page",
"url": "https://www.suse.com/security/cve/CVE-2022-29177/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-3162 page",
"url": "https://www.suse.com/security/cve/CVE-2022-3162/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-3294 page",
"url": "https://www.suse.com/security/cve/CVE-2022-3294/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-2431 page",
"url": "https://www.suse.com/security/cve/CVE-2023-2431/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-25809 page",
"url": "https://www.suse.com/security/cve/CVE-2023-25809/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-2727 page",
"url": "https://www.suse.com/security/cve/CVE-2023-2727/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-2728 page",
"url": "https://www.suse.com/security/cve/CVE-2023-2728/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-27561 page",
"url": "https://www.suse.com/security/cve/CVE-2023-27561/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-28642 page",
"url": "https://www.suse.com/security/cve/CVE-2023-28642/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-5528 page",
"url": "https://www.suse.com/security/cve/CVE-2023-5528/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45310 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45310/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-5321 page",
"url": "https://www.suse.com/security/cve/CVE-2024-5321/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-3445 page",
"url": "https://www.suse.com/security/cve/CVE-2025-3445/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47907 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47907/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47908 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47908/"
}
],
"title": "govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media",
"tracking": {
"current_release_date": "2025-08-08T00:00:00Z",
"generator": {
"date": "2025-08-08T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2025:15424-1",
"initial_release_date": "2025-08-08T00:00:00Z",
"revision_history": [
{
"date": "2025-08-08T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"product": {
"name": "govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"product_id": "govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"product": {
"name": "govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"product_id": "govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"product": {
"name": "govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"product_id": "govulncheck-vulndb-0.0.20250807T150727-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64",
"product": {
"name": "govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64",
"product_id": "govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64"
},
"product_reference": "govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le"
},
"product_reference": "govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "govulncheck-vulndb-0.0.20250807T150727-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x"
},
"product_reference": "govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
},
"product_reference": "govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-7561",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7561"
}
],
"notes": [
{
"category": "general",
"text": "Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7561",
"url": "https://www.suse.com/security/cve/CVE-2015-7561"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2015-7561"
},
{
"cve": "CVE-2016-9962",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-9962"
}
],
"notes": [
{
"category": "general",
"text": "RunC allowed additional container processes via \u0027runc exec\u0027 to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-9962",
"url": "https://www.suse.com/security/cve/CVE-2016-9962"
},
{
"category": "external",
"summary": "SUSE Bug 1012568 for CVE-2016-9962",
"url": "https://bugzilla.suse.com/1012568"
},
{
"category": "external",
"summary": "SUSE Bug 1173425 for CVE-2016-9962",
"url": "https://bugzilla.suse.com/1173425"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-9962"
},
{
"cve": "CVE-2017-1000056",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-1000056"
}
],
"notes": [
{
"category": "general",
"text": "Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-1000056",
"url": "https://www.suse.com/security/cve/CVE-2017-1000056"
},
{
"category": "external",
"summary": "SUSE Bug 1010675 for CVE-2017-1000056",
"url": "https://bugzilla.suse.com/1010675"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-1000056"
},
{
"cve": "CVE-2017-1002102",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-1002102"
}
],
"notes": [
{
"category": "general",
"text": "In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-1002102",
"url": "https://www.suse.com/security/cve/CVE-2017-1002102"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-1002102"
},
{
"cve": "CVE-2018-1002100",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1002100"
}
],
"notes": [
{
"category": "general",
"text": "In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1002100",
"url": "https://www.suse.com/security/cve/CVE-2018-1002100"
},
{
"category": "external",
"summary": "SUSE Bug 1089654 for CVE-2018-1002100",
"url": "https://bugzilla.suse.com/1089654"
},
{
"category": "external",
"summary": "SUSE Bug 1089991 for CVE-2018-1002100",
"url": "https://bugzilla.suse.com/1089991"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-1002100"
},
{
"cve": "CVE-2018-1002101",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1002101"
}
],
"notes": [
{
"category": "general",
"text": "In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1002101",
"url": "https://www.suse.com/security/cve/CVE-2018-1002101"
},
{
"category": "external",
"summary": "SUSE Bug 1118791 for CVE-2018-1002101",
"url": "https://bugzilla.suse.com/1118791"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2018-1002101"
},
{
"cve": "CVE-2018-16733",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-16733"
}
],
"notes": [
{
"category": "general",
"text": "In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-16733",
"url": "https://www.suse.com/security/cve/CVE-2018-16733"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-16733"
},
{
"cve": "CVE-2018-19184",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-19184"
}
],
"notes": [
{
"category": "general",
"text": "cmd/evm/runner.go in Go Ethereum (aka geth) 1.8.17 allows attackers to cause a denial of service (SEGV) via crafted bytecode.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-19184",
"url": "https://www.suse.com/security/cve/CVE-2018-19184"
},
{
"category": "external",
"summary": "SUSE Bug 1115634 for CVE-2018-19184",
"url": "https://bugzilla.suse.com/1115634"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2018-19184"
},
{
"cve": "CVE-2019-1002100",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-1002100"
}
],
"notes": [
{
"category": "general",
"text": "In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type \"json-patch\" (e.g. `kubectl patch --type json` or `\"Content-Type: application/json-patch+json\"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-1002100",
"url": "https://www.suse.com/security/cve/CVE-2019-1002100"
},
{
"category": "external",
"summary": "SUSE Bug 1127554 for CVE-2019-1002100",
"url": "https://bugzilla.suse.com/1127554"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2019-1002100"
},
{
"cve": "CVE-2019-1002101",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-1002101"
}
],
"notes": [
{
"category": "general",
"text": "The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user\u0027s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user\u0027s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-1002101",
"url": "https://www.suse.com/security/cve/CVE-2019-1002101"
},
{
"category": "external",
"summary": "SUSE Bug 1131056 for CVE-2019-1002101",
"url": "https://bugzilla.suse.com/1131056"
},
{
"category": "external",
"summary": "SUSE Bug 1138929 for CVE-2019-1002101",
"url": "https://bugzilla.suse.com/1138929"
},
{
"category": "external",
"summary": "SUSE Bug 1144507 for CVE-2019-1002101",
"url": "https://bugzilla.suse.com/1144507"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-1002101"
},
{
"cve": "CVE-2019-11245",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-11245"
}
],
"notes": [
{
"category": "general",
"text": "In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-11245",
"url": "https://www.suse.com/security/cve/CVE-2019-11245"
},
{
"category": "external",
"summary": "SUSE Bug 1136944 for CVE-2019-11245",
"url": "https://bugzilla.suse.com/1136944"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-11245"
},
{
"cve": "CVE-2019-11251",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-11251"
}
],
"notes": [
{
"category": "general",
"text": "The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-11251",
"url": "https://www.suse.com/security/cve/CVE-2019-11251"
},
{
"category": "external",
"summary": "SUSE Bug 1151300 for CVE-2019-11251",
"url": "https://bugzilla.suse.com/1151300"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-11251"
},
{
"cve": "CVE-2019-11253",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-11253"
}
],
"notes": [
{
"category": "general",
"text": "Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-11253",
"url": "https://www.suse.com/security/cve/CVE-2019-11253"
},
{
"category": "external",
"summary": "SUSE Bug 1152861 for CVE-2019-11253",
"url": "https://bugzilla.suse.com/1152861"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-11253"
},
{
"cve": "CVE-2020-26240",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-26240"
}
],
"notes": [
{
"category": "general",
"text": "Go Ethereum, or \"Geth\", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-26240",
"url": "https://www.suse.com/security/cve/CVE-2020-26240"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-26240"
},
{
"cve": "CVE-2020-26241",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-26241"
}
],
"notes": [
{
"category": "general",
"text": "Go Ethereum, or \"Geth\", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth\u0027s pre-compiled dataCopy (at 0x00...04) contract did a shallow copy on invocation. An attacker could deploy a contract that writes X to an EVM memory region R, then calls 0x00..04 with R as an argument, then overwrites R to Y, and finally invokes the RETURNDATACOPY opcode. When this contract is invoked, a consensus-compliant node would push X on the EVM stack, whereas Geth would push Y. This is fixed in version 1.9.17.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-26241",
"url": "https://www.suse.com/security/cve/CVE-2020-26241"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-26241"
},
{
"cve": "CVE-2020-8551",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-8551"
}
],
"notes": [
{
"category": "general",
"text": "The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-8551",
"url": "https://www.suse.com/security/cve/CVE-2020-8551"
},
{
"category": "external",
"summary": "SUSE Bug 1167509 for CVE-2020-8551",
"url": "https://bugzilla.suse.com/1167509"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-8551"
},
{
"cve": "CVE-2020-8555",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-8555"
}
],
"notes": [
{
"category": "general",
"text": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-8555",
"url": "https://www.suse.com/security/cve/CVE-2020-8555"
},
{
"category": "external",
"summary": "SUSE Bug 1171106 for CVE-2020-8555",
"url": "https://bugzilla.suse.com/1171106"
},
{
"category": "external",
"summary": "SUSE Bug 1185502 for CVE-2020-8555",
"url": "https://bugzilla.suse.com/1185502"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-8555"
},
{
"cve": "CVE-2020-8557",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-8557"
}
],
"notes": [
{
"category": "general",
"text": "The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-8557",
"url": "https://www.suse.com/security/cve/CVE-2020-8557"
},
{
"category": "external",
"summary": "SUSE Bug 1173984 for CVE-2020-8557",
"url": "https://bugzilla.suse.com/1173984"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-8557"
},
{
"cve": "CVE-2020-8558",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-8558"
}
],
"notes": [
{
"category": "general",
"text": "The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node\u0027s network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-8558",
"url": "https://www.suse.com/security/cve/CVE-2020-8558"
},
{
"category": "external",
"summary": "SUSE Bug 1172945 for CVE-2020-8558",
"url": "https://bugzilla.suse.com/1172945"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-8558"
},
{
"cve": "CVE-2020-8562",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-8562"
}
],
"notes": [
{
"category": "general",
"text": "As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-8562",
"url": "https://www.suse.com/security/cve/CVE-2020-8562"
},
{
"category": "external",
"summary": "SUSE Bug 1185502 for CVE-2020-8562",
"url": "https://bugzilla.suse.com/1185502"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-8562"
},
{
"cve": "CVE-2020-8563",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-8563"
}
],
"notes": [
{
"category": "general",
"text": "In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager\u0027s log. This affects \u003c v1.19.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-8563",
"url": "https://www.suse.com/security/cve/CVE-2020-8563"
},
{
"category": "external",
"summary": "SUSE Bug 1177659 for CVE-2020-8563",
"url": "https://bugzilla.suse.com/1177659"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-8563"
},
{
"cve": "CVE-2020-8566",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-8566"
}
],
"notes": [
{
"category": "general",
"text": "In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager\u0027s logs during provisioning of Ceph RBD persistent claims. This affects \u003c v1.19.3, \u003c v1.18.10, \u003c v1.17.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-8566",
"url": "https://www.suse.com/security/cve/CVE-2020-8566"
},
{
"category": "external",
"summary": "SUSE Bug 1177662 for CVE-2020-8566",
"url": "https://bugzilla.suse.com/1177662"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-8566"
},
{
"cve": "CVE-2021-25735",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-25735"
}
],
"notes": [
{
"category": "general",
"text": "A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-25735",
"url": "https://www.suse.com/security/cve/CVE-2021-25735"
},
{
"category": "external",
"summary": "SUSE Bug 1183409 for CVE-2021-25735",
"url": "https://bugzilla.suse.com/1183409"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-25735"
},
{
"cve": "CVE-2021-25736",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-25736"
}
],
"notes": [
{
"category": "general",
"text": "Kube-proxy\n on Windows can unintentionally forward traffic to local processes \nlistening on the same port (\"spec.ports[*].port\") as a LoadBalancer \nService when the LoadBalancer controller\n does not set the \"status.loadBalancer.ingress[].ip\" field. Clusters \nwhere the LoadBalancer controller sets the \n\"status.loadBalancer.ingress[].ip\" field are unaffected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-25736",
"url": "https://www.suse.com/security/cve/CVE-2021-25736"
},
{
"category": "external",
"summary": "SUSE Bug 1185894 for CVE-2021-25736",
"url": "https://bugzilla.suse.com/1185894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-25736"
},
{
"cve": "CVE-2021-25737",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-25737"
}
],
"notes": [
{
"category": "general",
"text": "A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-25737",
"url": "https://www.suse.com/security/cve/CVE-2021-25737"
},
{
"category": "external",
"summary": "SUSE Bug 1185503 for CVE-2021-25737",
"url": "https://bugzilla.suse.com/1185503"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-25737"
},
{
"cve": "CVE-2021-25741",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-25741"
}
],
"notes": [
{
"category": "general",
"text": "A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files \u0026 directories outside of the volume, including on the host filesystem.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-25741",
"url": "https://www.suse.com/security/cve/CVE-2021-25741"
},
{
"category": "external",
"summary": "SUSE Bug 1189416 for CVE-2021-25741",
"url": "https://bugzilla.suse.com/1189416"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-25741"
},
{
"cve": "CVE-2021-25743",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-25743"
}
],
"notes": [
{
"category": "general",
"text": "kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-25743",
"url": "https://www.suse.com/security/cve/CVE-2021-25743"
},
{
"category": "external",
"summary": "SUSE Bug 1194400 for CVE-2021-25743",
"url": "https://bugzilla.suse.com/1194400"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-25743"
},
{
"cve": "CVE-2021-30465",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-30465"
}
],
"notes": [
{
"category": "general",
"text": "runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-30465",
"url": "https://www.suse.com/security/cve/CVE-2021-30465"
},
{
"category": "external",
"summary": "SUSE Bug 1185405 for CVE-2021-30465",
"url": "https://bugzilla.suse.com/1185405"
},
{
"category": "external",
"summary": "SUSE Bug 1189161 for CVE-2021-30465",
"url": "https://bugzilla.suse.com/1189161"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-30465"
},
{
"cve": "CVE-2022-29162",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-29162"
}
],
"notes": [
{
"category": "general",
"text": "runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container\u0027s bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-29162",
"url": "https://www.suse.com/security/cve/CVE-2022-29162"
},
{
"category": "external",
"summary": "SUSE Bug 1199460 for CVE-2022-29162",
"url": "https://bugzilla.suse.com/1199460"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-29162"
},
{
"cve": "CVE-2022-29177",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-29177"
}
],
"notes": [
{
"category": "general",
"text": "Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Version 1.10.17 contains a patch that addresses the problem. As a workaround, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-29177",
"url": "https://www.suse.com/security/cve/CVE-2022-29177"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-29177"
},
{
"cve": "CVE-2022-3162",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-3162"
}
],
"notes": [
{
"category": "general",
"text": "Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-3162",
"url": "https://www.suse.com/security/cve/CVE-2022-3162"
},
{
"category": "external",
"summary": "SUSE Bug 1204388 for CVE-2022-3162",
"url": "https://bugzilla.suse.com/1204388"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-3162"
},
{
"cve": "CVE-2022-3294",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-3294"
}
],
"notes": [
{
"category": "general",
"text": "Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server\u0027s private network.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-3294",
"url": "https://www.suse.com/security/cve/CVE-2022-3294"
},
{
"category": "external",
"summary": "SUSE Bug 1204387 for CVE-2022-3294",
"url": "https://bugzilla.suse.com/1204387"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-3294"
},
{
"cve": "CVE-2023-2431",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-2431"
}
],
"notes": [
{
"category": "general",
"text": "A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-2431",
"url": "https://www.suse.com/security/cve/CVE-2023-2431"
},
{
"category": "external",
"summary": "SUSE Bug 1212493 for CVE-2023-2431",
"url": "https://bugzilla.suse.com/1212493"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2023-2431"
},
{
"cve": "CVE-2023-25809",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-25809"
}
],
"notes": [
{
"category": "general",
"text": "runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users\u0027s cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.\n",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-25809",
"url": "https://www.suse.com/security/cve/CVE-2023-25809"
},
{
"category": "external",
"summary": "SUSE Bug 1209884 for CVE-2023-25809",
"url": "https://bugzilla.suse.com/1209884"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2023-25809"
},
{
"cve": "CVE-2023-2727",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-2727"
}
],
"notes": [
{
"category": "general",
"text": "Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-2727",
"url": "https://www.suse.com/security/cve/CVE-2023-2727"
},
{
"category": "external",
"summary": "SUSE Bug 1211630 for CVE-2023-2727",
"url": "https://bugzilla.suse.com/1211630"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2023-2727"
},
{
"cve": "CVE-2023-2728",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-2728"
}
],
"notes": [
{
"category": "general",
"text": "Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account\u0027s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-2728",
"url": "https://www.suse.com/security/cve/CVE-2023-2728"
},
{
"category": "external",
"summary": "SUSE Bug 1211631 for CVE-2023-2728",
"url": "https://bugzilla.suse.com/1211631"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2023-2728"
},
{
"cve": "CVE-2023-27561",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-27561"
}
],
"notes": [
{
"category": "general",
"text": "runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-27561",
"url": "https://www.suse.com/security/cve/CVE-2023-27561"
},
{
"category": "external",
"summary": "SUSE Bug 1208962 for CVE-2023-27561",
"url": "https://bugzilla.suse.com/1208962"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2023-27561"
},
{
"cve": "CVE-2023-28642",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-28642"
}
],
"notes": [
{
"category": "general",
"text": "runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.\n\n",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-28642",
"url": "https://www.suse.com/security/cve/CVE-2023-28642"
},
{
"category": "external",
"summary": "SUSE Bug 1209888 for CVE-2023-28642",
"url": "https://bugzilla.suse.com/1209888"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2023-28642"
},
{
"cve": "CVE-2023-5528",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-5528"
}
],
"notes": [
{
"category": "general",
"text": "A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-5528",
"url": "https://www.suse.com/security/cve/CVE-2023-5528"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2023-5528"
},
{
"cve": "CVE-2024-45310",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45310"
}
],
"notes": [
{
"category": "general",
"text": "runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack\u0027s scope but the exact scope of protection hasn\u0027t been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3.\n\nSome workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the remapped root user/group has write access to. Unless the root user is remapped to an actual\nuser on the host (such as with rootless containers that don\u0027t use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict the scope if a specific label is applied to the runc runtime, though neither the extent to which the standard existing policies block this attack nor what exact policies are needed to sufficiently restrict this attack have been thoroughly tested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45310",
"url": "https://www.suse.com/security/cve/CVE-2024-45310"
},
{
"category": "external",
"summary": "SUSE Bug 1230092 for CVE-2024-45310",
"url": "https://bugzilla.suse.com/1230092"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2024-45310"
},
{
"cve": "CVE-2024-5321",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-5321"
}
],
"notes": [
{
"category": "general",
"text": "A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\\Users may be able to read container logs and NT AUTHORITY\\Authenticated Users may be able to modify container logs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-5321",
"url": "https://www.suse.com/security/cve/CVE-2024-5321"
},
{
"category": "external",
"summary": "SUSE Bug 1225420 for CVE-2024-5321",
"url": "https://bugzilla.suse.com/1225420"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2024-5321"
},
{
"cve": "CVE-2025-3445",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-3445"
}
],
"notes": [
{
"category": "general",
"text": "A Path Traversal \"Zip Slip\" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user\u0027s privileges or application utilizing the library.\n\nWhen using the archiver.Unarchive functionality with ZIP files, like this: archiver.Unarchive(zipFile, outputDir), A crafted ZIP file can be extracted in such a way that it writes files to the affected system with the same privileges as the application executing this vulnerable functionality. Consequently, sensitive files may be overwritten, potentially leading to privilege escalation, code execution, and other severe outcomes in some cases.\n\nIt\u0027s worth noting that a similar vulnerability was found in TAR files (CVE-2024-0406). Although a fix was implemented, it hasn\u0027t been officially released, and the affected project has since been deprecated. The successor to mholt/archiver is a new project called mholt/archives, and its initial release (v0.1.0) removes the Unarchive() functionality.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-3445",
"url": "https://www.suse.com/security/cve/CVE-2025-3445"
},
{
"category": "external",
"summary": "SUSE Bug 1241242 for CVE-2025-3445",
"url": "https://bugzilla.suse.com/1241242"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2025-3445"
},
{
"cve": "CVE-2025-47907",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47907"
}
],
"notes": [
{
"category": "general",
"text": "Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47907",
"url": "https://www.suse.com/security/cve/CVE-2025-47907"
},
{
"category": "external",
"summary": "SUSE Bug 1247720 for CVE-2025-47907",
"url": "https://bugzilla.suse.com/1247720"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-47907"
},
{
"cve": "CVE-2025-47908",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47908"
}
],
"notes": [
{
"category": "general",
"text": "Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47908",
"url": "https://www.suse.com/security/cve/CVE-2025-47908"
},
{
"category": "external",
"summary": "SUSE Bug 1247746 for CVE-2025-47908",
"url": "https://bugzilla.suse.com/1247746"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.aarch64",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.ppc64le",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.s390x",
"openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-08-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-47908"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…