Advisory Published

RHSA-2020:3194: Important: Container-native Virtualization security, bug fix, and enhancement update

First published: Tue Jul 28 2020(Updated: )

OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.<br>Security Fix(es):<br><li> kubevirt: VMIs can be used to access host files (CVE-2020-14316)</li> <li> containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters (CVE-2020-10749)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Additional Changes:<br>This update also fixes several bugs and adds various enhancements.<br>This advisory contains the following OpenShift Virtualization 2.4.0 images:<br>RHEL-7-CNV-2.4<br>==============<br>kubevirt-ssp-operator-container-v2.4.0-71<br>RHEL-8-CNV-2.4<br>==============<br>virt-cdi-controller-container-v2.4.0-29<br>virt-cdi-uploadproxy-container-v2.4.0-29<br>hostpath-provisioner-container-v2.4.0-25<br>virt-cdi-operator-container-v2.4.0-29<br>kubevirt-metrics-collector-container-v2.4.0-18<br>cnv-containernetworking-plugins-container-v2.4.0-36<br>kubevirt-kvm-info-nfd-plugin-container-v2.4.0-18<br>hostpath-provisioner-operator-container-v2.4.0-31<br>virt-cdi-uploadserver-container-v2.4.0-29<br>virt-cdi-apiserver-container-v2.4.0-29<br>virt-controller-container-v2.4.0-58<br>virt-cdi-cloner-container-v2.4.0-29<br>kubevirt-template-validator-container-v2.4.0-21<br>vm-import-operator-container-v2.4.0-21<br>kubernetes-nmstate-handler-container-v2.4.0-37<br>node-maintenance-operator-container-v2.4.0-27<br>virt-operator-container-v2.4.0-58<br>kubevirt-v2v-conversion-container-v2.4.0-23<br>cnv-must-gather-container-v2.4.0-73<br>virtio-win-container-v2.4.0-15<br>kubevirt-cpu-node-labeller-container-v2.4.0-19<br>ovs-cni-plugin-container-v2.4.0-37<br>kubevirt-vmware-container-v2.4.0-21<br>hyperconverged-cluster-operator-container-v2.4.0-70<br>virt-handler-container-v2.4.0-58<br>virt-cdi-importer-container-v2.4.0-29<br>virt-launcher-container-v2.4.0-58<br>kubevirt-cpu-model-nfd-plugin-container-v2.4.0-17<br>virt-api-container-v2.4.0-58<br>ovs-cni-marker-container-v2.4.0-38<br>kubemacpool-container-v2.4.0-39<br>cluster-network-addons-operator-container-v2.4.0-38<br>bridge-marker-container-v2.4.0-39<br>vm-import-controller-container-v2.4.0-21<br>hco-bundle-registry-container-v2.3.0-497

Affected SoftwareAffected VersionHow to fix
Red Hat OpenShift Virtualization
Red Hat Kubevirt SSP Operator
Red Hat virt-cdi-controller
Red Hat virt-cdi-uploadproxy
Red Hat HostPath Provisioner
Red Hat Virt CDI Operator
Red Hat Kubevirt Metrics Collector
Red Hat CNV Container Networking Plugins
Red Hat KubeVirt KVM Info NFD Plugin
Red Hat HostPath Provisioner Operator
Red Hat virt-cdi-uploadserver
Red Hat virt-cdi-apiserver
Red Hat Virt Controller
Red Hat virt-cdi-cloner
Red Hat KubeVirt Template Validator
Red Hat vm-import-operator
Red Hat Kubernetes NMState Handler
Red Hat Node Maintenance Operator
Red Hat virt-operator
Red Hat Kubevirt V2V Conversion
Red Hat cnv-must-gather
virtio-win
Red Hat Kubevirt CPU Node Labeller
Red Hat ovs-cni-plugin
Red Hat Kubevirt
Red Hat Hyperconverged Cluster Operator
Red Hat virt-handler
Red Hat virt-cdi-importer
Red Hat virt-launcher
Red Hat KubeVirt KVM Info NFD Plugin
Red Hat virt-api
Red Hat ovs-cni-marker
Red Hat kubemacpool
Red Hat cluster-network-addons-operator
Red Hat Bridge Marker
Red Hat vm-import-controller
Red Hat HCO Bundle Registry

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of RHSA-2020:3194?

    The severity of RHSA-2020:3194 is classified as critical due to vulnerabilities that could allow unauthorized access to host files and enable potential network exposure.

  • How do I fix RHSA-2020:3194?

    To fix RHSA-2020:3194, you should apply the latest security updates as provided by Red Hat for OpenShift Virtualization.

  • What vulnerabilities are addressed in RHSA-2020:3194?

    RHSA-2020:3194 addresses vulnerabilities including CVE-2020-14316 that allows VMIs to access host files.

  • Which products are affected by RHSA-2020:3194?

    RHSA-2020:3194 affects the Red Hat OpenShift Container Platform, specifically its virtualization components.

  • Is there a workaround for RHSA-2020:3194?

    There are no specific workarounds mentioned for RHSA-2020:3194, so immediate patching is recommended.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203