RHSA-2020:5363: Moderate: OpenShift Container Platform 3.11.346 security and bug fix update
Published Dec 16, 2020
·Updated
Red Hat OpenShift Container Platform is Red Hat's cloud computingKubernetes application platform solution designed for on-premise or privatecloud deployments.Security Fix(es): kubernetes: compromised node could escalate to cluster level privileges (CVE-2020-8559) kubernetes: improper validation of URL redirection in the Kubernetes API server allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints (CVE-2018-1002102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.This advisory contains the RPM packages for Red Hat OpenShift ContainerPlatform 3.11.346. See the following advisory for the container images for this release:https://access.redhat.com/errata/RHBA-2020:5362 All OpenShift Container Platform 3.11 users are advised to upgrade to theseupdated packages and images.
Affected Software
76 affected componentsFixes available
redhat/atomic-enterprise-service-catalog<3.11.346-1.git.1675.f80310c.el7
3.11.346-1.git.1675.f80310c.el7
redhat/atomic-openshift<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-cluster-autoscaler<3.11.346-1.git.0.d16fdd8.el7
3.11.346-1.git.0.d16fdd8.el7
redhat/atomic-openshift-descheduler<3.11.346-1.git.299.eda6813.el7
3.11.346-1.git.299.eda6813.el7
redhat/atomic-openshift-dockerregistry<3.11.346-1.git.481.1a70926.el7
3.11.346-1.git.481.1a70926.el7
redhat/atomic-openshift-metrics-server<3.11.346-1.git.53.f310e77.el7
3.11.346-1.git.53.f310e77.el7
redhat/atomic-openshift-node-problem-detector<3.11.346-1.git.263.335bb76.el7
3.11.346-1.git.263.335bb76.el7
redhat/atomic-openshift-service-idler<3.11.346-1.git.15.35bbcf7.el7
3.11.346-1.git.15.35bbcf7.el7
redhat/atomic-openshift-web-console<3.11.346-1.git.619.3bb8f35.el7
3.11.346-1.git.619.3bb8f35.el7
redhat/golang-github-openshift-oauth-proxy<3.11.346-1.git.439.d3d1b1e.el7
3.11.346-1.git.439.d3d1b1e.el7
redhat/golang-github-prometheus-alertmanager<3.11.346-1.git.0.c2f0036.el7
3.11.346-1.git.0.c2f0036.el7
redhat/golang-github-prometheus-prometheus<3.11.346-1.git.5026.2eafa83.el7
3.11.346-1.git.5026.2eafa83.el7
redhat/openshift-ansible<3.11.346-1.git.0.f65cc70.el7
3.11.346-1.git.0.f65cc70.el7
redhat/openshift-enterprise-autoheal<3.11.346-1.git.218.08313c9.el7
3.11.346-1.git.218.08313c9.el7
redhat/openshift-enterprise-cluster-capacity<3.11.346-1.git.379.a389b99.el7
3.11.346-1.git.379.a389b99.el7
redhat/openshift-kuryr<3.11.346-1.git.1478.b99caab.el7
3.11.346-1.git.1478.b99caab.el7
redhat/atomic-enterprise-service-catalog<3.11.346-1.git.1675.f80310c.el7
3.11.346-1.git.1675.f80310c.el7
redhat/atomic-enterprise-service-catalog-svcat<3.11.346-1.git.1675.f80310c.el7
3.11.346-1.git.1675.f80310c.el7
redhat/atomic-openshift<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-clients<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-clients-redistributable<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-cluster-autoscaler<3.11.346-1.git.0.d16fdd8.el7
3.11.346-1.git.0.d16fdd8.el7
redhat/atomic-openshift-descheduler<3.11.346-1.git.299.eda6813.el7
3.11.346-1.git.299.eda6813.el7
redhat/atomic-openshift-docker-excluder<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-dockerregistry<3.11.346-1.git.481.1a70926.el7
3.11.346-1.git.481.1a70926.el7
redhat/atomic-openshift-excluder<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-hyperkube<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-hypershift<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-master<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-metrics-server<3.11.346-1.git.53.f310e77.el7
3.11.346-1.git.53.f310e77.el7
redhat/atomic-openshift-node<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-node-problem-detector<3.11.346-1.git.263.335bb76.el7
3.11.346-1.git.263.335bb76.el7
redhat/atomic-openshift-pod<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-sdn-ovs<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-service-idler<3.11.346-1.git.15.35bbcf7.el7
3.11.346-1.git.15.35bbcf7.el7
redhat/atomic-openshift-template-service-broker<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-tests<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-web-console<3.11.346-1.git.619.3bb8f35.el7
3.11.346-1.git.619.3bb8f35.el7
redhat/golang-github-openshift-oauth-proxy<3.11.346-1.git.439.d3d1b1e.el7
3.11.346-1.git.439.d3d1b1e.el7
redhat/openshift-ansible<3.11.346-1.git.0.f65cc70.el7
3.11.346-1.git.0.f65cc70.el7
redhat/openshift-ansible-docs<3.11.346-1.git.0.f65cc70.el7
3.11.346-1.git.0.f65cc70.el7
redhat/openshift-ansible-playbooks<3.11.346-1.git.0.f65cc70.el7
3.11.346-1.git.0.f65cc70.el7
redhat/openshift-ansible-roles<3.11.346-1.git.0.f65cc70.el7
3.11.346-1.git.0.f65cc70.el7
redhat/openshift-enterprise-autoheal<3.11.346-1.git.218.08313c9.el7
3.11.346-1.git.218.08313c9.el7
redhat/openshift-enterprise-cluster-capacity<3.11.346-1.git.379.a389b99.el7
3.11.346-1.git.379.a389b99.el7
redhat/openshift-kuryr-cni<3.11.346-1.git.1478.b99caab.el7
3.11.346-1.git.1478.b99caab.el7
redhat/openshift-kuryr-common<3.11.346-1.git.1478.b99caab.el7
3.11.346-1.git.1478.b99caab.el7
redhat/openshift-kuryr-controller<3.11.346-1.git.1478.b99caab.el7
3.11.346-1.git.1478.b99caab.el7
redhat/prometheus<3.11.346-1.git.5026.2eafa83.el7
3.11.346-1.git.5026.2eafa83.el7
redhat/prometheus-alertmanager<3.11.346-1.git.0.c2f0036.el7
3.11.346-1.git.0.c2f0036.el7
redhat/prometheus-node-exporter<3.11.346-1.git.1062.c498733.el7
3.11.346-1.git.1062.c498733.el7
redhat/python2-kuryr-kubernetes<3.11.346-1.git.1478.b99caab.el7
3.11.346-1.git.1478.b99caab.el7
redhat/atomic-enterprise-service-catalog<3.11.346-1.git.1675.f80310c.el7
3.11.346-1.git.1675.f80310c.el7
redhat/atomic-enterprise-service-catalog-svcat<3.11.346-1.git.1675.f80310c.el7
3.11.346-1.git.1675.f80310c.el7
redhat/atomic-openshift<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-clients<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-cluster-autoscaler<3.11.346-1.git.0.d16fdd8.el7
3.11.346-1.git.0.d16fdd8.el7
redhat/atomic-openshift-descheduler<3.11.346-1.git.299.eda6813.el7
3.11.346-1.git.299.eda6813.el7
redhat/atomic-openshift-hyperkube<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-hypershift<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-master<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-metrics-server<3.11.346-1.git.53.f310e77.el7
3.11.346-1.git.53.f310e77.el7
redhat/atomic-openshift-node<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-node-problem-detector<3.11.346-1.git.263.335bb76.el7
3.11.346-1.git.263.335bb76.el7
redhat/atomic-openshift-pod<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-sdn-ovs<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-service-idler<3.11.346-1.git.15.35bbcf7.el7
3.11.346-1.git.15.35bbcf7.el7
redhat/atomic-openshift-template-service-broker<3.11.346-1.git.0.ea10721.el7
3.11.346-1.git.0.ea10721.el7
redhat/atomic-openshift-web-console<3.11.346-1.git.619.3bb8f35.el7
3.11.346-1.git.619.3bb8f35.el7
redhat/golang-github-openshift-oauth-proxy<3.11.346-1.git.439.d3d1b1e.el7
3.11.346-1.git.439.d3d1b1e.el7
redhat/openshift-ansible-test<3.11.346-1.git.0.f65cc70.el7
3.11.346-1.git.0.f65cc70.el7
redhat/openshift-enterprise-autoheal<3.11.346-1.git.218.08313c9.el7
3.11.346-1.git.218.08313c9.el7
redhat/openshift-enterprise-cluster-capacity<3.11.346-1.git.379.a389b99.el7
3.11.346-1.git.379.a389b99.el7
redhat/prometheus<3.11.346-1.git.5026.2eafa83.el7
3.11.346-1.git.5026.2eafa83.el7
redhat/prometheus-alertmanager<3.11.346-1.git.0.c2f0036.el7
3.11.346-1.git.0.c2f0036.el7
redhat/prometheus-node-exporter<3.11.346-1.git.1062.c498733.el7
3.11.346-1.git.1062.c498733.el7
Remediation
Event History
Dec 16, 2020
Advisory Published
via Red Hat·12:00 AM
Frequently Asked Questions
1
What is the severity of RHSA-2020:5363?
The severity of RHSA-2020:5363 is considered to be critical due to the potential for privilege escalation in the Kubernetes cluster.
2
How do I fix RHSA-2020:5363?
To fix RHSA-2020:5363, you should update the affected packages to the specified versions listed in the advisory.
3
What vulnerabilities are addressed in RHSA-2020:5363?
RHSA-2020:5363 addresses the CVE-2020-8559 vulnerability affecting Kubernetes which could allow a compromised node to escalate privileges.
4
Which packages are affected by RHSA-2020:5363?
Affected packages include atomic-openshift, atomic-openshift-cluster-autoscaler, atomic-openshift-descheduler, and several others listed in the advisory.
5
What platforms are affected by RHSA-2020:5363?
RHSA-2020:5363 affects the Red Hat OpenShift Container Platform deployments on various architectures, including x86_64 and ppc64le.