RHSA-2020:2027: Moderate: OpenShift Container Platform 4.2.33 openshift-clients security update
Red Hat OpenShift Container Platform is Red Hat's cloud computingKubernetes application platform solution designed for on-premise or privatecloud deployments.Security Fix(es): proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openshift-clientsto a version that resolves this vulnerability.Fixed in 4.2.32-202005020632.git.1.1b0fab9.el8 - Upgrade
Upgrade
redhat/openshift-clients-redistributableto a version that resolves this vulnerability.Fixed in 4.2.32-202005020632.git.1.1b0fab9.el8 - Upgrade
Upgrade
OpenShift Container Platformto a version that resolves this vulnerability.Fixed in 4.2.33
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:2027?
The severity of RHSA-2020:2027 is classified as moderate.
How do I fix RHSA-2020:2027?
To fix RHSA-2020:2027, update the affected packages to version 4.2.32-202005020632.git.1.1b0fab9.el8.
What vulnerability does RHSA-2020:2027 address?
RHSA-2020:2027 addresses a use-after-free vulnerability in GPGME bindings during container image pull.
Which packages are affected by RHSA-2020:2027?
The affected packages include openshift-clients and openshift-clients-redistributable.
Is there a workaround for RHSA-2020:2027?
There is no official workaround for RHSA-2020:2027, and updating the packages is recommended.