CVE-2020-27836: Critical severity red hat openshift container platform vulnerability
A flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source ranges could allow an attacker to access resources that would otherwise be restricted to specified IP ranges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability..
Other sources
Until the 4.6.6 version of OpenShift Container Platform changes to the router-default service to allow only certain IP source ranges was possible by directly editing the service object [1]. Since 4.6.6 changes to the loadBalancerSourceRanges field are overwritten to the default of all IP ranges. If a cluster is affected by this issue an attacker can use the flaw to access resources which should be restricted to the specified IP ranges.
[1] https://access.redhat.com/solutions/5158751
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-27836?
The severity of CVE-2020-27836 is critical due to its potential impact on data confidentiality.
How do I fix CVE-2020-27836?
To fix CVE-2020-27836, upgrade the ose-cluster-ingress-operator-container to version 202012161211 or later.
Which software is affected by CVE-2020-27836?
CVE-2020-27836 affects ose-cluster-ingress-operator-container version v4.6.0 up to but not including 202012161211.
What types of attacks can CVE-2020-27836 facilitate?
CVE-2020-27836 can allow unauthorized access to resources by manipulating IP source ranges.
Is Red Hat OpenShift Container Platform vulnerable to CVE-2020-27836?
Yes, Red Hat OpenShift Container Platform version 4.6 is vulnerable to CVE-2020-27836.