{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Container Platform release 4.5.16 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\nRed Hat Product Security has rated this update as having a security impact\nof Low. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* openshift: Restricted SCC allows pods to craft custom network packets (CVE-2020-14336)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2020:4320",
        "url": "https://access.redhat.com/errata/RHSA-2020:4320"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "1856529",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856529"
      },
      {
        "category": "external",
        "summary": "1858981",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1858981"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2020/rhsa-2020_4320.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 4.5.16 security update",
    "tracking": {
      "current_release_date": "2024-09-16T04:54:43+00:00",
      "generator": {
        "date": "2024-09-16T04:54:43+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.33.3"
        }
      },
      "id": "RHSA-2020:4320",
      "initial_release_date": "2020-10-26T14:41:36+00:00",
      "revision_history": [
        {
          "date": "2020-10-26T14:41:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2020-10-26T14:41:37+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-09-16T04:54:43+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.5",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.5",
                  "product_id": "7Server-RH7-RHOSE-4.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.5::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift4/ose-machine-config-operator@sha256:0d08b01798a96cb124e07a40e6953ad220bc2055f926e27517c2fe202beae812_ppc64le",
                "product": {
                  "name": "openshift4/ose-machine-config-operator@sha256:0d08b01798a96cb124e07a40e6953ad220bc2055f926e27517c2fe202beae812_ppc64le",
                  "product_id": "openshift4/ose-machine-config-operator@sha256:0d08b01798a96cb124e07a40e6953ad220bc2055f926e27517c2fe202beae812_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ose-machine-config-operator@sha256:0d08b01798a96cb124e07a40e6953ad220bc2055f926e27517c2fe202beae812?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift4/ose-machine-config-operator\u0026tag=v4.5.0-202010160047.p0"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift4/ose-machine-config-operator@sha256:2ac7d8e5a4a1a8a0cbb06ac6302a146b256e413f54d62dca553c11e1dcc0661d_amd64",
                "product": {
                  "name": "openshift4/ose-machine-config-operator@sha256:2ac7d8e5a4a1a8a0cbb06ac6302a146b256e413f54d62dca553c11e1dcc0661d_amd64",
                  "product_id": "openshift4/ose-machine-config-operator@sha256:2ac7d8e5a4a1a8a0cbb06ac6302a146b256e413f54d62dca553c11e1dcc0661d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ose-machine-config-operator@sha256:2ac7d8e5a4a1a8a0cbb06ac6302a146b256e413f54d62dca553c11e1dcc0661d?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-machine-config-operator\u0026tag=v4.5.0-202010160047.p0"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift4/ose-machine-config-operator@sha256:56347b9b9aa202c3ea4ee5fc6c6d4e78bb5aa20d3cc358ef41c5640c45d7538f_s390x",
                "product": {
                  "name": "openshift4/ose-machine-config-operator@sha256:56347b9b9aa202c3ea4ee5fc6c6d4e78bb5aa20d3cc358ef41c5640c45d7538f_s390x",
                  "product_id": "openshift4/ose-machine-config-operator@sha256:56347b9b9aa202c3ea4ee5fc6c6d4e78bb5aa20d3cc358ef41c5640c45d7538f_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ose-machine-config-operator@sha256:56347b9b9aa202c3ea4ee5fc6c6d4e78bb5aa20d3cc358ef41c5640c45d7538f?arch=s390x\u0026repository_url=registry.redhat.io/openshift4/ose-machine-config-operator\u0026tag=v4.5.0-202010160047.p0"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-machine-config-operator@sha256:0d08b01798a96cb124e07a40e6953ad220bc2055f926e27517c2fe202beae812_ppc64le as a component of Red Hat OpenShift Container Platform 4.5",
          "product_id": "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:0d08b01798a96cb124e07a40e6953ad220bc2055f926e27517c2fe202beae812_ppc64le"
        },
        "product_reference": "openshift4/ose-machine-config-operator@sha256:0d08b01798a96cb124e07a40e6953ad220bc2055f926e27517c2fe202beae812_ppc64le",
        "relates_to_product_reference": "7Server-RH7-RHOSE-4.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-machine-config-operator@sha256:2ac7d8e5a4a1a8a0cbb06ac6302a146b256e413f54d62dca553c11e1dcc0661d_amd64 as a component of Red Hat OpenShift Container Platform 4.5",
          "product_id": "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:2ac7d8e5a4a1a8a0cbb06ac6302a146b256e413f54d62dca553c11e1dcc0661d_amd64"
        },
        "product_reference": "openshift4/ose-machine-config-operator@sha256:2ac7d8e5a4a1a8a0cbb06ac6302a146b256e413f54d62dca553c11e1dcc0661d_amd64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-4.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-machine-config-operator@sha256:56347b9b9aa202c3ea4ee5fc6c6d4e78bb5aa20d3cc358ef41c5640c45d7538f_s390x as a component of Red Hat OpenShift Container Platform 4.5",
          "product_id": "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:56347b9b9aa202c3ea4ee5fc6c6d4e78bb5aa20d3cc358ef41c5640c45d7538f_s390x"
        },
        "product_reference": "openshift4/ose-machine-config-operator@sha256:56347b9b9aa202c3ea4ee5fc6c6d4e78bb5aa20d3cc358ef41c5640c45d7538f_s390x",
        "relates_to_product_reference": "7Server-RH7-RHOSE-4.5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Yuval Kashtan"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2020-14336",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2020-06-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1858981"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allows an attacker to cause a denial of service attack on an OpenShift Container Platform cluster if they can deploy pods. The highest threat from this vulnerability is to system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openshift: restricted SCC allows pods to craft custom network packets",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "By default, the OpenShift Container Platform uses the OpenShift SDN network interface. This interface makes this attack impractical by implementing IPTable rules on the host side of the virtual network interface, isolating network traffic to within the pod.\n\nIf the OpenShift Container Platform has the sriov-network-operator deployed, it is at a greater risk for exploitation. \n\nIf installing a new OCP 4.6 cluster no changes are required. If upgrading a cluster from an earlier version to 4.5.16 be sure to delete 99-worker-generated-crio-capabilities and 99-master-generated-crio-capabilities machine controllers once you have tested that dropping NET_RAW does not break your cluster workload.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:0d08b01798a96cb124e07a40e6953ad220bc2055f926e27517c2fe202beae812_ppc64le",
          "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:2ac7d8e5a4a1a8a0cbb06ac6302a146b256e413f54d62dca553c11e1dcc0661d_amd64",
          "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:56347b9b9aa202c3ea4ee5fc6c6d4e78bb5aa20d3cc358ef41c5640c45d7538f_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-14336"
        },
        {
          "category": "external",
          "summary": "RHBZ#1858981",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1858981"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14336",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-14336"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14336",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14336"
        }
      ],
      "release_date": "2020-07-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For OpenShift Container Platform 4.5 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.",
          "product_ids": [
            "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:0d08b01798a96cb124e07a40e6953ad220bc2055f926e27517c2fe202beae812_ppc64le",
            "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:2ac7d8e5a4a1a8a0cbb06ac6302a146b256e413f54d62dca553c11e1dcc0661d_amd64",
            "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:56347b9b9aa202c3ea4ee5fc6c6d4e78bb5aa20d3cc358ef41c5640c45d7538f_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:4320"
        },
        {
          "category": "workaround",
          "details": "On OCP 3.11 create a custom SCC based on \u0027restricted\u0027 and also drop the NET_RAW capability[1]. Assign this custom SCC to any users, or groups which create pods you want to protect. See the documentation for more information [2]. \n[1] https://access.redhat.com/solutions/5611521\n[2] https://docs.openshift.com/container-platform/3.11/admin_guide/manage_scc.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:0d08b01798a96cb124e07a40e6953ad220bc2055f926e27517c2fe202beae812_ppc64le",
            "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:2ac7d8e5a4a1a8a0cbb06ac6302a146b256e413f54d62dca553c11e1dcc0661d_amd64",
            "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:56347b9b9aa202c3ea4ee5fc6c6d4e78bb5aa20d3cc358ef41c5640c45d7538f_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:0d08b01798a96cb124e07a40e6953ad220bc2055f926e27517c2fe202beae812_ppc64le",
            "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:2ac7d8e5a4a1a8a0cbb06ac6302a146b256e413f54d62dca553c11e1dcc0661d_amd64",
            "7Server-RH7-RHOSE-4.5:openshift4/ose-machine-config-operator@sha256:56347b9b9aa202c3ea4ee5fc6c6d4e78bb5aa20d3cc358ef41c5640c45d7538f_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openshift: restricted SCC allows pods to craft custom network packets"
    }
  ]
}