Red Hat Security Advisory: OpenShift Container Platform 4.4.19 openshift-enterprise-hyperkube-container security update
An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-8557US | medium5.5 | — | ||
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/h… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (6)
- Behobenopenshift4/ose-hyperkube@sha256:506ed9928ad388879b3eb077ba9d738aa17f8e574b9274f7d4aff1fa97225b0d_ppc64le as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.19, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3580 - Behobenopenshift4/ose-hyperkube@sha256:7c085a5778b2abbfba07bd68abc925ec3618ee8d5b9c58acd243c31e507853e9_s390x as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.19, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3580 - Behobenopenshift4/ose-hyperkube@sha256:ebbc8bbb5beb73a73b46f4a9c7a83eb2e25142c2fd08b7481b79013ebfec0052_amd64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.19, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3580 - Workaroundopenshift4/ose-hyperkube@sha256:506ed9928ad388879b3eb077ba9d738aa17f8e574b9274f7d4aff1fa97225b0d_ppc64le as a component of Red Hat OpenShift Container Platform 4.4
On OpenShift Container Platform (OCP) 3.11 and 4.x it's possible to set the allowPrivilegeEscalation Security Context Constraint to 'false' to prevent this. Note that this is set to 'true' by default, and setting it to false will prevent certain binaries which require setuid to stop working. On OCP 3.11 for example the 'ping' command will no longer work [1]. On OCP 4.x and later the 'ping' command will work with allowPrivilegeEscalation set to False, but other setuid binaries will not work. [1] https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html
- Workaroundopenshift4/ose-hyperkube@sha256:7c085a5778b2abbfba07bd68abc925ec3618ee8d5b9c58acd243c31e507853e9_s390x as a component of Red Hat OpenShift Container Platform 4.4
On OpenShift Container Platform (OCP) 3.11 and 4.x it's possible to set the allowPrivilegeEscalation Security Context Constraint to 'false' to prevent this. Note that this is set to 'true' by default, and setting it to false will prevent certain binaries which require setuid to stop working. On OCP 3.11 for example the 'ping' command will no longer work [1]. On OCP 4.x and later the 'ping' command will work with allowPrivilegeEscalation set to False, but other setuid binaries will not work. [1] https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html
- Workaroundopenshift4/ose-hyperkube@sha256:ebbc8bbb5beb73a73b46f4a9c7a83eb2e25142c2fd08b7481b79013ebfec0052_amd64 as a component of Red Hat OpenShift Container Platform 4.4
On OpenShift Container Platform (OCP) 3.11 and 4.x it's possible to set the allowPrivilegeEscalation Security Context Constraint to 'false' to prevent this. Note that this is set to 'true' by default, and setting it to false will prevent certain binaries which require setuid to stop working. On OCP 3.11 for example the 'ping' command will no longer work [1]. On OCP 4.x and later the 'ping' command will work with allowPrivilegeEscalation set to False, but other setuid binaries will not work. [1] https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan