rhsa-2021_0949
Vulnerability from csaf_redhat
Published
2021-03-22 10:10
Modified
2024-11-22 16:18
Summary
Red Hat Security Advisory: Red Hat OpenShift Do openshift/odo-init-image 1.1.3 security update
Notes
Topic
Updated openshift/odo-init-image container image is now available for Red Hat Openshift Do 1.0.
Details
Red Hat OpenShift Do (odo) is a simple CLI tool for developers to create,
build, and deploy applications on OpenShift. The odo tool is completely
client-based and requires no server within the OpenShift cluster for
deployment. It detects changes to local code and deploys it to the cluster
automatically, giving instant feedback to validate changes in real-time. It
supports multiple programming languages and frameworks.
Red Hat OpenShift Do openshift/odo-init-image 1.1.3 is a container image
that is used as part of the InitContainer setup that provisions odo
components.
The advisory addresses the following issues:
* Re-release of odo-init-image 1.1.3 for security updates
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated openshift/odo-init-image container image is now available for Red Hat Openshift Do 1.0.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Do (odo) is a simple CLI tool for developers to create,\nbuild, and deploy applications on OpenShift. The odo tool is completely\nclient-based and requires no server within the OpenShift cluster for\ndeployment. It detects changes to local code and deploys it to the cluster\nautomatically, giving instant feedback to validate changes in real-time. It\nsupports multiple programming languages and frameworks.\n\nRed Hat OpenShift Do openshift/odo-init-image 1.1.3 is a container image\nthat is used as part of the InitContainer setup that provisions odo\ncomponents.\n\nThe advisory addresses the following issues:\n\n* Re-release of odo-init-image 1.1.3 for security updates",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:0949",
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "https://docs.openshift.com/container-platform/4.4/cli_reference/openshift_developer_cli/installing-odo.html",
"url": "https://docs.openshift.com/container-platform/4.4/cli_reference/openshift_developer_cli/installing-odo.html"
},
{
"category": "external",
"summary": "1832983",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1832983"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0949.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift Do openshift/odo-init-image 1.1.3 security update",
"tracking": {
"current_release_date": "2024-11-22T16:18:07+00:00",
"generator": {
"date": "2024-11-22T16:18:07+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:0949",
"initial_release_date": "2021-03-22T10:10:55+00:00",
"revision_history": [
{
"date": "2021-03-22T10:10:55+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-03-22T10:10:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T16:18:07+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Do 1",
"product": {
"name": "OpenShift Do 1",
"product_id": "7Server-RHODO-1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_do:1.0::el7"
}
}
}
],
"category": "product_family",
"name": "OpenShift Do"
},
{
"branches": [
{
"category": "product_version",
"name": "openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64",
"product": {
"name": "openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64",
"product_id": "openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64",
"product_identification_helper": {
"purl": "pkg:oci/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96?arch=amd64\u0026repository_url=registry.redhat.io/openshiftdo/odo-init-image-rhel7\u0026tag=1.1.3-2"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 as a component of OpenShift Do 1",
"product_id": "7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
},
"product_reference": "openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64",
"relates_to_product_reference": "7Server-RHODO-1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-20843",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2019-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1723723"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the \"setElementTypePrefix()\" function incorrectly extracted XML namespace prefixes. By tricking an application into processing a specially crafted XML file, an attacker could cause unusually high consumption of memory resources and possibly lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: large number of colons in input makes parser consume high amount of resources, leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "When processing a specially crafted XML file, expat may use more memory than ultimately necessary, which can also lead to increased CPU usage and longer processing times. Depending on available system resources and configuration, this may also lead to the application triggering the Out-Of-Memory-Killer, causing the application to be terminated.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-20843"
},
{
"category": "external",
"summary": "RHBZ#1723723",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1723723"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-20843",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20843"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-20843",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20843"
},
{
"category": "external",
"summary": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031"
}
],
"release_date": "2019-06-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "expat: large number of colons in input makes parser consume high amount of resources, leading to DoS"
},
{
"cve": "CVE-2019-5094",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2019-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1768555"
}
],
"notes": [
{
"category": "description",
"text": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "e2fsprogs: Crafted ext4 partition leads to out-of-bounds write",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-5094"
},
{
"category": "external",
"summary": "RHBZ#1768555",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1768555"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-5094",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5094"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5094",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5094"
},
{
"category": "external",
"summary": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887"
}
],
"release_date": "2019-08-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "e2fsprogs: Crafted ext4 partition leads to out-of-bounds write"
},
{
"cve": "CVE-2019-5188",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2020-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1790048"
}
],
"notes": [
{
"category": "description",
"text": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "e2fsprogs: Out-of-bounds write in e2fsck/rehash.c",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-5188"
},
{
"category": "external",
"summary": "RHBZ#1790048",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790048"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-5188",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5188"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5188",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5188"
}
],
"release_date": "2020-01-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "e2fsprogs: Out-of-bounds write in e2fsck/rehash.c"
},
{
"acknowledgments": [
{
"names": [
"the Curl project"
]
},
{
"names": [
"Thomas Vegas"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2019-5482",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2019-09-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1749652"
}
],
"notes": [
{
"category": "description",
"text": "Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: heap buffer overflow in function tftp_receive_packet()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-5482"
},
{
"category": "external",
"summary": "RHBZ#1749652",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1749652"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-5482",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5482"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5482",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5482"
},
{
"category": "external",
"summary": "https://curl.haxx.se/docs/CVE-2019-5482.html",
"url": "https://curl.haxx.se/docs/CVE-2019-5482.html"
}
],
"release_date": "2019-09-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "Do not use TFTP with curl with smaller than the default BLKSIZE.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: heap buffer overflow in function tftp_receive_packet()"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Henry Corrigan-Gibbs"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2019-11719",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2019-07-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1728436"
}
],
"notes": [
{
"category": "description",
"text": "When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: Out-of-bounds read when importing curve25519 private key",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Firefox on Red Hat Enterprise Linux is built against the system nss library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-11719"
},
{
"category": "external",
"summary": "RHBZ#1728436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-11719",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11719"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11719",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11719"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719"
}
],
"release_date": "2019-07-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: Out-of-bounds read when importing curve25519 private key"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Hubert Kario"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2019-11727",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2019-07-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1730988"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox \u003c 68.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: PKCS#1 v1.5 signatures can be used for TLS 1.3",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-11727"
},
{
"category": "external",
"summary": "RHBZ#1730988",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730988"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-11727",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11727"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11727",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11727"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727"
}
],
"release_date": "2019-07-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nss: PKCS#1 v1.5 signatures can be used for TLS 1.3"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
}
],
"cve": "CVE-2019-11756",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2019-11-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1774835"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free flaw was found in Mozilla Network Security Services (NSS) related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: Use-after-free in sftk_FreeSession due to improper refcounting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw was fixed in upstream nss-3.47. Exploitation of this flaw is difficult and even impossible in most cases.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-11756"
},
{
"category": "external",
"summary": "RHBZ#1774835",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1774835"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-11756",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11756"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11756",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11756"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes"
}
],
"release_date": "2019-12-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: Use-after-free in sftk_FreeSession due to improper refcounting"
},
{
"cve": "CVE-2019-12450",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"discovery_date": "2019-06-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1719141"
}
],
"notes": [
{
"category": "description",
"text": "file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of glib2 as shipped with Red Hat Enterprise Linux 6, 7 and 8 . Red Hat Product Security has rated this issue as having a security impact of Moderate.\n\nRed Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-12450"
},
{
"category": "external",
"summary": "RHBZ#1719141",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1719141"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-12450",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12450"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-12450",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12450"
}
],
"release_date": "2019-05-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress"
},
{
"acknowledgments": [
{
"names": [
"the D-Bus project"
]
},
{
"names": [
"Joe Vennix"
],
"organization": "Apple Information Security",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2019-12749",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2019-06-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1719344"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in dbus. The implementation of DBUS_COOKIE_SHA1 is susceptible to a symbolic link attack. A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause the DBusServer to read and write in unintended locations resulting in an authentication bypass. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is mitigated by the fact that by default, the well-known system dbus-daemon (since 2003) and the well-known session dbus-daemon (in stable releases since dbus 1.10.0 in 2015) only accept the EXTERNAL authentication mechanism, and as a result will reject DBUS_COOKIE_SHA1 at an early stage, before manipulating cookies. \n\nRed Hat Enterprise Linux 6 is affected by this flaw, which can be leveraged to achieve privilege escalation via upstart. This issue has been rated as having important impact for Red Hat Enterprise Linux 6.\n\nRed Hat Enterprise Linux 7 and 8, both ship dbus \u003e= 1.10 and therefore are affected by this flaw only when system or session dbus-daemons are used under non-standard configurations or by third party users of DBusServer. Red Hat Enterprise Linux 7 and 8 does not ship any affected DBusServer cosumer. However third party applications may be affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-12749"
},
{
"category": "external",
"summary": "RHBZ#1719344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1719344"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-12749",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12749"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-12749",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12749"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2019/06/11/2",
"url": "https://www.openwall.com/lists/oss-security/2019/06/11/2"
}
],
"release_date": "2019-06-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass"
},
{
"acknowledgments": [
{
"names": [
"Simon McVittie"
],
"organization": "Collabora Ltd."
}
],
"cve": "CVE-2019-14822",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2019-06-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1717958"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was discovered in ibus that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ibus: missing authorization allows local attacker to access the input bus of another user",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Gnome uses the ibus input framework only when the user explicitly configures it or when some input method sources are in use, like Korean from the ibus-hangul package or Chinese input methods from the ibus-libpinyin. Input methods like en-US are not handled by ibus, thus if the victim user just use them the attacker will not be able to intercept the key strokes of that user.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-14822"
},
{
"category": "external",
"summary": "RHBZ#1717958",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1717958"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-14822",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-14822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14822"
}
],
"release_date": "2019-09-13T07:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ibus: missing authorization allows local attacker to access the input bus of another user"
},
{
"acknowledgments": [
{
"names": [
"Thomas Habets"
]
}
],
"cve": "CVE-2019-14866",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2019-10-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1765511"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpio: improper input validation when writing tar header fields leads to unexpected tar generation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-14866"
},
{
"category": "external",
"summary": "RHBZ#1765511",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1765511"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-14866",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14866"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-14866",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14866"
}
],
"release_date": "2019-08-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "TAR archives should be inspected before being extracted and the extraction should be performed with the `tar` command or `--no-absolute-filenames` option if done with `cpio`. Moreover, it should be performed by a low-privilege user whenever possible, to prevent extraction of files that could compromise the system.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpio: improper input validation when writing tar header fields leads to unexpected tar generation"
},
{
"cve": "CVE-2019-15903",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2019-09-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1752592"
}
],
"notes": [
{
"category": "description",
"text": "In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: heap-based buffer over-read via crafted XML input",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-15903"
},
{
"category": "external",
"summary": "RHBZ#1752592",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752592"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-15903",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15903"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-15903",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15903"
}
],
"release_date": "2019-09-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "expat: heap-based buffer over-read via crafted XML input"
},
{
"cve": "CVE-2019-16935",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2019-09-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1763229"
}
],
"notes": [
{
"category": "description",
"text": "A reflected cross-site scripting (XSS) vulnerability was found in Python XML-RPC server. The `server_title` field is not sufficiently sanitized allowing malicious JavaScript to be injected. Successful exploitation would allow a remote attacker to execute JavaScript code within the context of the affected user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: XSS vulnerability in the documentation XML-RPC server in server_title field",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw does not affect the versions of python27-python as shipped with Red Hat Software Collections 3 as they already include the fix.\nThis flaw does not affect the versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 as they are \"symlinks\" to the main python3 component, which provides the actual interpreter of the Python programming language.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-16935"
},
{
"category": "external",
"summary": "RHBZ#1763229",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1763229"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-16935",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16935"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-16935",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16935"
}
],
"release_date": "2019-09-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python: XSS vulnerability in the documentation XML-RPC server in server_title field"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla Project"
]
}
],
"cve": "CVE-2019-17006",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2019-11-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1775916"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: Check length of inputs for cryptographic primitives",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-17006"
},
{
"category": "external",
"summary": "RHBZ#1775916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1775916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-17006",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17006"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17006",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17006"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes"
}
],
"release_date": "2019-12-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: Check length of inputs for cryptographic primitives"
},
{
"cve": "CVE-2019-17023",
"discovery_date": "2020-01-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1791225"
}
],
"notes": [
{
"category": "description",
"text": "A protocol downgrade flaw was found in Network Security Services (NSS). After a HelloRetryRequest has been sent, the client may negotiate a lower protocol than TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw causes the client to hang when there is a downgrade attempt. Therefore no actual protocol downgrade occurs.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-17023"
},
{
"category": "external",
"summary": "RHBZ#1791225",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1791225"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-17023",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17023"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17023",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17023"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes"
}
],
"release_date": "2020-01-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state"
},
{
"cve": "CVE-2019-17498",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2019-10-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1766898"
}
],
"notes": [
{
"category": "description",
"text": "In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw needs a malicious MITM SSH server. When an application compiled with libssh2 connects to such a MITM SSH server, the server can trigger an integer overflow leading to an OOB read in the SSH_MSG_DISCONNECT logic. This can cause the application compiled with libssh2 to crash. This is strictly a client side crash and the SSH server may not be affected.\n\nAlso note that when a user connects to a malicious MITM server there is already a risk of disclosing password/keys irrespective of the flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-17498"
},
{
"category": "external",
"summary": "RHBZ#1766898",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1766898"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-17498",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17498"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17498",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17498"
},
{
"category": "external",
"summary": "https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/",
"url": "https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/"
}
],
"release_date": "2019-10-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c"
},
{
"cve": "CVE-2019-19126",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2019-11-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1774681"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in glibc where the LD_PREFER_MAP_32BIT_EXEC environment variable is not ignored when running binaries with the setuid flag on x86_64 architectures. This allows an attacker to force system to utilize only half of the memory (making the system think the software is 32-bit only), thus lowering the amount of memory being used with address space layout randomization (ASLR). The highest threat is confidentiality although the complexity of attack is high. The affected application must already have other vulnerabilities for this flaw to be usable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-19126"
},
{
"category": "external",
"summary": "RHBZ#1774681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1774681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-19126",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19126"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-19126",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19126"
}
],
"release_date": "2019-11-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries"
},
{
"cve": "CVE-2019-19956",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2020-01-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1788856"
}
],
"notes": [
{
"category": "description",
"text": "xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc-\u003eoldNs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-19956"
},
{
"category": "external",
"summary": "RHBZ#1788856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1788856"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-19956",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19956"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-19956",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19956"
}
],
"release_date": "2020-01-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c"
},
{
"cve": "CVE-2019-20386",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2020-01-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1793979"
}
],
"notes": [
{
"category": "description",
"text": "A memory leak was discovered in the systemd-login when a power-switch event is received. A physical attacker may trigger one of these events and leak bytes due to a missing free.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "systemd: memory leak in button_open() in login/logind-button.c when udev events are received",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The version of systemd delivered in OpenShift Container Platform 4.1 and included in CoreOS images has been superseded by the version delivered in Red Hat Enterprise Linux 8. CoreOS updates for systemd in will be consumed from Red Hat Enterprise Linux 8 channels.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-20386"
},
{
"category": "external",
"summary": "RHBZ#1793979",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1793979"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-20386",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20386"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20386",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20386"
}
],
"release_date": "2020-01-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "LOW",
"baseScore": 2.4,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "systemd: memory leak in button_open() in login/logind-button.c when udev events are received"
},
{
"cve": "CVE-2019-20388",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"discovery_date": "2020-02-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1799734"
}
],
"notes": [
{
"category": "description",
"text": "A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. System availability is the highest threat from this vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-20388"
},
{
"category": "external",
"summary": "RHBZ#1799734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1799734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-20388",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20388"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20388",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20388"
}
],
"release_date": "2020-01-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c"
},
{
"cve": "CVE-2019-20907",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2020-07-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1856481"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: infinite loop in the tarfile module via crafted TAR archive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A service is vulnerable if it uses python\u0027s tarfile module to open untrusted tar files. If an attacker is able to submit a crafted tar file to a service which uses the tarfile module to open it, an infinite loop will be executed, potentially causing a denial of service. The tarfile module is included with python.\n\nVersions of `python36:3.6/python36` as shipped with Red Hat Enterprise Linux 8 are marked as \u0027Not affected\u0027 as they just provide \"symlinks\" to the main `python3` component, which provides the actual interpreter of the Python programming language.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-20907"
},
{
"category": "external",
"summary": "RHBZ#1856481",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856481"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-20907",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20907"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20907",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20907"
}
],
"release_date": "2019-12-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "This flaw can be mitigated by not opening untrusted files with tarfile.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python: infinite loop in the tarfile module via crafted TAR archive"
},
{
"cve": "CVE-2019-25013",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2021-01-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1912960"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could cause glibc to read beyond the end of a buffer, resulting in a segmentation fault. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has been rated as having moderate impact for glibc packages shipped with Red Hat Enterprise Linux because, the maximum impact of this vulnerability is a crash, and it relies on processing untrusted input in an uncommon encoding (EUC-KR). When this encoding is not used, the vulnerability can not be triggered.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-25013"
},
{
"category": "external",
"summary": "RHBZ#1912960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912960"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-25013",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-25013"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-25013",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25013"
}
],
"release_date": "2019-09-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding"
},
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"David Benjamin"
],
"organization": "Google",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-1971",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2020-12-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1903409"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: EDIPARTYNAME NULL pointer de-reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. \n\n1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.\n\n2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.\n\nThird party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.\n\nGENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1971"
},
{
"category": "external",
"summary": "RHBZ#1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20201208.txt",
"url": "https://www.openssl.org/news/secadv/20201208.txt"
}
],
"release_date": "2020-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssl: EDIPARTYNAME NULL pointer de-reference"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla Project"
]
},
{
"names": [
"Cesar Pereida",
"Nicola Tuveri",
"Yuval Yarom",
"Billy Bob Brumley"
],
"organization": "Network and Information Security Group (NISEC",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-6829",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2020-04-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1826187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: Side channel attack on ECDSA signature generation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a side channel attack which can used to exact pirate keys when ECDSA signatures are being generated. This attack is only feasible when the attacker is local to the machine or in certain cross-VM scenarios where the signature is being generated. Attacks over the network or via the internet are not feasible.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-6829"
},
{
"category": "external",
"summary": "RHBZ#1826187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1826187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-6829",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-6829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-6829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6829"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes"
}
],
"release_date": "2020-06-02T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: Side channel attack on ECDSA signature generation"
},
{
"cve": "CVE-2020-7595",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2020-02-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1799786"
}
],
"notes": [
{
"category": "description",
"text": "xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-7595"
},
{
"category": "external",
"summary": "RHBZ#1799786",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1799786"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-7595",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7595"
}
],
"release_date": "2020-01-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations"
},
{
"cve": "CVE-2020-8177",
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1847915"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. Overwriting local files is possible when using a certain combination of command line options. Requesting content from a malicious server could lead to overwriting local files with compromised files leading to unknown effects. The highest threat from this vulnerability is to file integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: Incorrect argument check can allow remote servers to overwrite local files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue only affects the \u0027curl\u0027 command line utility. Additionally, this is only an issue when using the \u0027-J\u0027 (with the \u0027-O\u0027 option) and \u0027-i\u0027 command line options combined.\n\nIn most cases, there is nothing to gain for a local attacker here: the curl command line utility is likely running with the same privileges as the user, and thus the user can already overwrite all the files curl could overwrite. However, a local user will have to call curl with the \u0027-J\u0027 and \u0027-i\u0027 command line options while requesting content from a malicious server, which then opens up an opportunity for the malicious server to overwrite local files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8177"
},
{
"category": "external",
"summary": "RHBZ#1847915",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847915"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8177",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8177"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8177",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8177"
},
{
"category": "external",
"summary": "https://curl.haxx.se/docs/CVE-2020-8177.html",
"url": "https://curl.haxx.se/docs/CVE-2020-8177.html"
}
],
"release_date": "2020-06-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "The vulnerability is only possible when using the \u0027-J\u0027 and \u0027-i\u0027 switches in conjunction with the curl command. Executing curl without these switches mitigates the flaw.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: Incorrect argument check can allow remote servers to overwrite local files"
},
{
"cve": "CVE-2020-10029",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2020-03-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1810670"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc in versions prior to 2.32. Pseudo-zero values are not validated causing a stack corruption due to a stack-based overflow. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The glibc version shipped with Red Hat Enterprise Linux 8 is compiled using gcc\u0027s stack-protector option which mitigates the possibility of code execution led by the stack corruption.\n\nThe glibc version shipped with Red Hat Enterprise Linux 7 is more difficult to exploit using this flaw, specifically for remote code execution. Because exploitation of the flaw depends on the usage of pseudo-zero values, an attacker can only overwrite the stack with 0s. Due to this, a valid address value for code execution is difficult to get and is likely to only result in a crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10029"
},
{
"category": "external",
"summary": "RHBZ#1810670",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1810670"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10029",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10029"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10029",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10029"
}
],
"release_date": "2020-02-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions"
},
{
"cve": "CVE-2020-12243",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2020-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1833535"
}
],
"notes": [
{
"category": "description",
"text": "In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openldap: denial of service via nested boolean expressions in LDAP search filters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does not affect Red Hat Enterprise Linux 8 because we don\u0027t ship openldap-servers subpackage with the Red Hat Enterprise Linux 8 (it is only present in the buildroot).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-12243"
},
{
"category": "external",
"summary": "RHBZ#1833535",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1833535"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-12243",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12243"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12243",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12243"
}
],
"release_date": "2020-04-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openldap: denial of service via nested boolean expressions in LDAP search filters"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla Project"
]
},
{
"names": [
"Cesar Pereida Garcia and the Network and Information Security Group"
],
"organization": "NISEC",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-12400",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2020-07-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1853983"
}
],
"notes": [
{
"category": "description",
"text": "A side-channel flaw was found in NSS, in the way P-384 and P-521 curves are used in the generation of EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a side-channel attack that can be used to exact pirate keys when ECDSA signatures are being generated. This attack is only feasible when the attacker is local to the machine or in certain cross-VM scenarios where the signature is being generated. Attacks over the network or via the internet are not feasible.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-12400"
},
{
"category": "external",
"summary": "RHBZ#1853983",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1853983"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-12400",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12400"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12400",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12400"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes"
}
],
"release_date": "2020-07-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla Project"
]
},
{
"names": [
"Cesar Pereida Garcia and the Network and Information Security Group"
],
"organization": "NISEC",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-12401",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2020-06-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1851294"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: ECDSA timing attack mitigation bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a side channel attack which can used to exact pirate keys when ECDSA signatures are being generated. This attack is only feasible when the attacker is local to the machine or in certain cross-VM scenarios where the signature is being generated. Attacks over the network or via the internet are not feasible.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-12401"
},
{
"category": "external",
"summary": "RHBZ#1851294",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1851294"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-12401",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12401"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12401",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12401"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes"
}
],
"release_date": "2020-06-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "This is a side channel attack which can used to exact pirate keys when ECDSA signatures are being generated. This attack is only feasible when the attacker is local to the machine or in certain cross-VM scenarios where the signature is being generated. Attacks over the network or via the internet are not feasible.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: ECDSA timing attack mitigation bypass"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla Project"
]
},
{
"names": [
"Billy Bob Brumley",
"Cesar Pereida",
"Nicola Tuveri",
"Yuval Yarom"
],
"organization": "Network and Information Security Group (NISEC",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-12402",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2020-04-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1826231"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NSS, where it is vulnerable to RSA key generation cache timing side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. The highest threat to this flaw is to confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: Side channel vulnerabilities during RSA key generation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A timing attack was found in the way NSS generated RSA keys. A man-in-the-middle attacker could use this attack during RSA key generation to recover the private key. This attack is only feasible when the attacker is local to the machine or in certain cross-VM scenarios where the signature is being generated. Attacks over the network or via the internet are not feasible.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-12402"
},
{
"category": "external",
"summary": "RHBZ#1826231",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1826231"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-12402",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12402"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12402",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12402"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53.1_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53.1_release_notes"
}
],
"release_date": "2020-06-02T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: Side channel vulnerabilities during RSA key generation"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla Project"
]
}
],
"cve": "CVE-2020-12403",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2020-08-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1868931"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-12403"
},
{
"category": "external",
"summary": "RHBZ#1868931",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868931"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-12403",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12403"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12403",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12403"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes"
}
],
"release_date": "2020-07-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read"
},
{
"cve": "CVE-2020-29573",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2020-12-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1905213"
}
],
"notes": [
{
"category": "description",
"text": "A stack buffer overflow flaw was found in glibc in the way the printf family of functions processed an 80-bit long double with a non-canonical bit pattern. This flaw allows an attacker who can control the arguments of these functions with the non-standard long double pattern to trigger an overflow and cause an application crash. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is essentially a crash which can only be triggered by a non-standard argument passed as a long double input to a member of printf family of functions. The application has to be written in this way to allow this issue to be triggered. The maximum impact is an application crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-29573"
},
{
"category": "external",
"summary": "RHBZ#1905213",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1905213"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-29573",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-29573"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-29573",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29573"
},
{
"category": "external",
"summary": "https://sourceware.org/pipermail/libc-alpha/2020-September/117779.html",
"url": "https://sourceware.org/pipermail/libc-alpha/2020-September/117779.html"
}
],
"release_date": "2020-09-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.