Red Hat Security Advisory: OpenShift Container Platform 4.5.7 openshift-enterprise-hyperkube-container security update
An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.5. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-8557US | medium5.5 | — | ||
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/h… | ||||
references
External citations — patches, advisories, analysis.
remediations (6)
- Fixedopenshift4/ose-hyperkube@sha256:830614358a9e59a02f3e46fcaae60713cdb2b5263a8bdc518da14951d2364302_ppc64le as a component of Red Hat OpenShift Container Platform 4.5
For OpenShift Container Platform 4.5 see the following documentation, which will be updated shortly for release 4.5.7, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3520 - Fixedopenshift4/ose-hyperkube@sha256:b331e1b8097cc86402f23aaf4975943487cb375310232f71f54d83160aa8c854_amd64 as a component of Red Hat OpenShift Container Platform 4.5
For OpenShift Container Platform 4.5 see the following documentation, which will be updated shortly for release 4.5.7, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3520 - Fixedopenshift4/ose-hyperkube@sha256:b3450188d682c952d840bdac34a349f9c832e057a086b936b8341abf8dd3b0b5_s390x as a component of Red Hat OpenShift Container Platform 4.5
For OpenShift Container Platform 4.5 see the following documentation, which will be updated shortly for release 4.5.7, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3520 - Workaroundopenshift4/ose-hyperkube@sha256:830614358a9e59a02f3e46fcaae60713cdb2b5263a8bdc518da14951d2364302_ppc64le as a component of Red Hat OpenShift Container Platform 4.5
On OpenShift Container Platform (OCP) 3.11 and 4.x it's possible to set the allowPrivilegeEscalation Security Context Constraint to 'false' to prevent this. Note that this is set to 'true' by default, and setting it to false will prevent certain binaries which require setuid to stop working. On OCP 3.11 for example the 'ping' command will no longer work [1]. On OCP 4.x and later the 'ping' command will work with allowPrivilegeEscalation set to False, but other setuid binaries will not work. [1] https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html
- Workaroundopenshift4/ose-hyperkube@sha256:b331e1b8097cc86402f23aaf4975943487cb375310232f71f54d83160aa8c854_amd64 as a component of Red Hat OpenShift Container Platform 4.5
On OpenShift Container Platform (OCP) 3.11 and 4.x it's possible to set the allowPrivilegeEscalation Security Context Constraint to 'false' to prevent this. Note that this is set to 'true' by default, and setting it to false will prevent certain binaries which require setuid to stop working. On OCP 3.11 for example the 'ping' command will no longer work [1]. On OCP 4.x and later the 'ping' command will work with allowPrivilegeEscalation set to False, but other setuid binaries will not work. [1] https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html
- Workaroundopenshift4/ose-hyperkube@sha256:b3450188d682c952d840bdac34a349f9c832e057a086b936b8341abf8dd3b0b5_s390x as a component of Red Hat OpenShift Container Platform 4.5
On OpenShift Container Platform (OCP) 3.11 and 4.x it's possible to set the allowPrivilegeEscalation Security Context Constraint to 'false' to prevent this. Note that this is set to 'true' by default, and setting it to false will prevent certain binaries which require setuid to stop working. On OCP 3.11 for example the 'ping' command will no longer work [1]. On OCP 4.x and later the 'ping' command will work with allowPrivilegeEscalation set to False, but other setuid binaries will not work. [1] https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan