CVE-2020-1750
First published: Thu Feb 27 2020(Updated: )
A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amount of memory. An attacker could use this flaw to deny access to schedule new pods in the OpenShift cluster. This was fixed in openshift/machine-config-operator 4.4.3, openshift/machine-config-operator 4.3.25, openshift/machine-config-operator 4.2.36.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openshift/machine-config-operator | <4.4.3 | 4.4.3 |
| redhat/openshift/machine-config-operator | <4.3.25 | 4.3.25 |
| redhat/openshift/machine-config-operator | <4.2.36 | 4.2.36 |
| Redhat Machine-config-operator | >=4.2.0<4.2.36 | |
| Redhat Machine-config-operator | >=4.3.0<4.3.25 | |
| Redhat Machine-config-operator | >=4.4.0<4.4.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/openshift/machine-config-operator/pull/1450
- https://access.redhat.com/errata/RHSA-2020:1939
- https://access.redhat.com/security/cve/cve-2020-1750
- https://access.redhat.com/errata/RHSA-2020:2439
- https://access.redhat.com/errata/RHSA-2020:2595
- https://bugzilla.redhat.com/show_bug.cgi?id=1808130
Frequently Asked Questions
What is the severity of CVE-2020-1750?
CVE-2020-1750 is classified as a moderate severity vulnerability.
How do I fix CVE-2020-1750?
To fix CVE-2020-1750, upgrade to openshift/machine-config-operator versions 4.4.3, 4.3.25, or 4.2.36 or newer.
What causes the vulnerability CVE-2020-1750?
CVE-2020-1750 is caused by a flaw in the machine-config-operator that leads to an OpenShift node becoming unresponsive under high memory consumption by containers.
What is the impact of CVE-2020-1750 on my OpenShift cluster?
The impact of CVE-2020-1750 is that it can lead to denial of access for scheduling new pods in the OpenShift cluster.
Which versions of openshift/machine-config-operator are affected by CVE-2020-1750?
Versions of openshift/machine-config-operator from prior to 4.4.3, 4.3.25, and 4.2.36 are affected by CVE-2020-1750.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-1750
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/author
- agent/remedy
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/source
- vendor/redhat
- canonical/redhat machine-config-operator
- version/redhat machine-config-operator/4.2.0
- version/redhat machine-config-operator/4.3.0
- version/redhat machine-config-operator/4.4.0
- package-manager/redhat