RHSA-2020:2413: Moderate: OpenShift Container Platform 4.5 package security update
Red Hat OpenShift Container Platform is Red Hat's cloud computingKubernetes application platform solution designed for on-premise or privatecloud deployments.Security Fix(es): kubernetes: Denial of service in API server via crafted YAML payloads by authorized users (CVE-2019-11254) kubernetes: node localhost services reachable via martian packets (CVE-2020-8558) proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/machine-config-daemonto a version that resolves this vulnerability.Fixed in 4.5.0-202007012112.p0.git.2527.d12c3da.el8 - Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 4.5.0-202007012112.p0.git.0.582d7fc.el8 - Upgrade
Upgrade
redhat/openshift-hyperkubeto a version that resolves this vulnerability.Fixed in 4.5.0-202007012112.p0.git.0.582d7fc.el8 - Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 4.5.0-202007012112.p0.git.0.582d7fc.el7 - Upgrade
Upgrade
redhat/openshift-hyperkubeto a version that resolves this vulnerability.Fixed in 4.5.0-202007012112.p0.git.0.582d7fc.el7 - Upgrade
Upgrade
Red Hat OpenShift Container Platformto a version that resolves this vulnerability.Fixed in 4.5.1
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:2413?
The severity of RHSA-2020:2413 is classified as a Denial of Service vulnerability.
How do I fix RHSA-2020:2413?
To fix RHSA-2020:2413, upgrade the affected packages to the specified remedial versions provided in the advisory.
Which software versions are affected by RHSA-2020:2413?
RHSA-2020:2413 affects specific versions of the machine-config-daemon and OpenShift packages, particularly those prior to 4.5.0-202007012112.p0.
What type of issue does RHSA-2020:2413 address?
RHSA-2020:2413 addresses a Denial of Service issue in the API server that can be triggered by crafted YAML payloads from authorized users.
Is the vulnerability in RHSA-2020:2413 exploitable remotely?
Yes, the vulnerability in RHSA-2020:2413 can be exploited by authorized users who have access to the API server.