REDHAT-BUG-1926568
First published: Tue Feb 09 2021(Updated: )
When running OpenShift with Red Hat supported network types, applications in the cluster are blocked from sending traffic to ports 22623 or 22624 via iptables rules injected into the pod. This ensures that no unprivileged workloads are able to access the Machine Config Server (MCS) and download ignition configuration, which may contain sensitive information. Unfortunately, this security measure is implemented within the code for the network plugins, so a cluster that uses another network plugin (like Calico, for example), would not have this protection mechanism in place. In other words, all applications running on OpenShift clusters not using Red Hat supported network types will be able to access the MCS.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat OpenShift Origin |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-1926568?
The severity of REDHAT-BUG-1926568 is considered high as it prevents unprivileged workloads from accessing the Machine Config Server.
How do I fix REDHAT-BUG-1926568?
To fix REDHAT-BUG-1926568, ensure that your network policies allow access to ports 22623 and 22624 as needed.
Which applications are affected by REDHAT-BUG-1926568?
REDHAT-BUG-1926568 affects applications running on Red Hat OpenShift with certain network types configured.
What is the impact of REDHAT-BUG-1926568?
The impact of REDHAT-BUG-1926568 is that applications in the OpenShift cluster are blocked from sending traffic to the Machine Config Server.
Does REDHAT-BUG-1926568 affect all versions of OpenShift?
REDHAT-BUG-1926568 specifically affects the Red Hat OpenShift product without specifying particular versions.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-20238
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat openshift origin