Red Hat Security Advisory: OpenShift Container Platform 4.10.24 bug fix and security update
Red Hat OpenShift Container Platform release 4.10.24 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-2403US | medium6.5 | — | ||
A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps,… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2022:5664self
- https://access.redhat.com/security/updates/classification/#importantexternal
- 2084187external
- 2084629external
- 2098626external
- 2099206external
- 2099686external
- 2101959external
Behebungen (44)
- Behobenopenshift4/ose-cluster-authentication-operator@sha256:1d99daa5c6ecb553e242ce8094ca7997ac86b95718b23c22cea543e297babe87_s390x as a component of Red Hat OpenShift Container Platform 4.10
For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:5664 - Behobenopenshift4/ose-cluster-authentication-operator@sha256:af357b15ec5585c7790d263b406a236c0ae19f58cfc5437b330f40bb0b34a81c_arm64 as a component of Red Hat OpenShift Container Platform 4.10
For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:5664 - Behobenopenshift4/ose-cluster-authentication-operator@sha256:c508fa70683286c0dd9a06ae372595b3542764a84469e593ed3d1d59e43fc7e3_ppc64le as a component of Red Hat OpenShift Container Platform 4.10
For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:5664 - Behobenopenshift4/ose-cluster-authentication-operator@sha256:f83b96670eb0a103da8a3bcc899f153a1419eb3074a8e3c06f60c1607d5fd29a_amd64 as a component of Red Hat OpenShift Container Platform 4.10
For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2022:5664 - Workaroundopenshift4/network-tools-rhel8@sha256:40901700825940a9f52fbb45c90899d817edb0527b1b4298952eb873d99aa44b_s390x as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/network-tools-rhel8@sha256:4960434212de04c015a7fa081d81d906258360e5c7843dead22a59584e3b310d_amd64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/network-tools-rhel8@sha256:9b76635dd4b181243b129c7dd876f06822827eb4c58cbb554d4801212ce72618_arm64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/network-tools-rhel8@sha256:dc8e3376690d643b30442fad5027b0f2b90eef7766a646036ea6ecfb872e8d78_ppc64le as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-cluster-authentication-operator@sha256:1d99daa5c6ecb553e242ce8094ca7997ac86b95718b23c22cea543e297babe87_s390x as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-cluster-authentication-operator@sha256:af357b15ec5585c7790d263b406a236c0ae19f58cfc5437b330f40bb0b34a81c_arm64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-cluster-authentication-operator@sha256:c508fa70683286c0dd9a06ae372595b3542764a84469e593ed3d1d59e43fc7e3_ppc64le as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-cluster-authentication-operator@sha256:f83b96670eb0a103da8a3bcc899f153a1419eb3074a8e3c06f60c1607d5fd29a_amd64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-cluster-version-operator@sha256:468113932fc984de471e3dd4122e069a4b65abad925752eed9e7791f84cc1cae_s390x as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-cluster-version-operator@sha256:70e70b8408c096396dedb1964c706186254349045ad8122293999b22d7d31761_ppc64le as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-cluster-version-operator@sha256:922a13f32acdef27df6ba7cfaca56c1b76659676bf640eb4159e56871e4530fa_amd64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-cluster-version-operator@sha256:be750dbb5213f1105cec7a02d83ce94708883e027b8279555e0198995b986563_arm64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-console@sha256:28d9e77255f6a46360523ea96d5573b6f0aced54102a30c5e9b3084fcd135d06_s390x as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-console@sha256:45dc849e93bce6adb0844701e18000a7a86694abbb2c9567b6756f8e491a1d8d_arm64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-console@sha256:9320f40055ac79b89d27bd7686579ae68ee711c3707f94ffecc239815635ec47_ppc64le as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-console@sha256:986dc829c7c120796285e29fee62e935dc36d04bcaea13a3e13013a8a627a541_amd64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-csi-driver-manila-rhel8-operator@sha256:029ab1de11baf3a5b329bf37210f9772b94d3133c5eafa26f9f1e61309c28ddb_ppc64le as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-csi-driver-manila-rhel8-operator@sha256:9a7ee8014b45c837b3ee86879f0e6a12e793672e193a18c97ac29681ccd671af_amd64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-machine-config-operator@sha256:15a1c16d1ea330b8e0d8ec07d416b5682400a629ed54cfec596e70ff3ea29c43_s390x as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-machine-config-operator@sha256:504a9de1e7e394a89b4eefcb749407d5d62a06090a06c2fa0d40300df99075df_ppc64le as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-machine-config-operator@sha256:a9826b166492f0eb7e722a9cfebf6b7732a3cb38c6f773ed90b3c4e0d3766282_arm64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-machine-config-operator@sha256:c710929fb76c8539f0d8ed4e7ebacd54667859b87dac5a32a7c58734ed2250e4_amd64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-openstack-cinder-csi-driver-rhel8-operator@sha256:4ab54a88691f63709f618a0547426dc5c389bf5863c70ae0b0e002d1365ae421_s390x as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-openstack-cinder-csi-driver-rhel8-operator@sha256:6d67517862bfe1331bca617b197d887d2e7b4527a0f4f4b81b279aac5033b235_arm64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-openstack-cinder-csi-driver-rhel8-operator@sha256:7aaff65e959ad603b156abba6e48aee39307120a6219353aa9caccbc1c2fb8a4_ppc64le as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-openstack-cinder-csi-driver-rhel8-operator@sha256:804e6a04853196f87651c7cfad3d490c509f079526c860d27a8d99f6ae9e4156_amd64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-operator-lifecycle-manager@sha256:0deeed68b85da61e9cf10f402dcc5811f4189061905f66f8c1a196f6d6e3b421_ppc64le as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-operator-lifecycle-manager@sha256:77b5e2baef4438c88d2ef22ef15cc62bca598a27449cd890fafcbe5260b331a0_s390x as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-operator-lifecycle-manager@sha256:8cdcba7828543261dd951e3b5e4b41dff9584043cce633b98f8ab3b4db496bee_arm64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-operator-lifecycle-manager@sha256:cc477d763835d8c874b050223261dde5bcd73429f0cb55aa7f7cde3df892ce0f_amd64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-operator-registry@sha256:7aadadfc70dfa304fbc989fdbe9591adc38ecae9b4e9d80a822dedd6b28d6108_ppc64le as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-operator-registry@sha256:8de7a35f7ca26e678b8e3d8bf5fa6aa80b84287413247dc031a785d0d139698c_amd64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-operator-registry@sha256:a75e7869a3966e8a5fd490f042a6b6281ac9f2d217404b261c4e3602d6a5cb3e_s390x as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-operator-registry@sha256:b52c8543a62b8791e09e1c2983458ff4f405f97c06d930d68f7f7a87abdac46b_arm64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-ovn-kubernetes@sha256:1d0a2d08c4a9107cea073cfbfcd2bd4f1dd736bd138d72c2cc8d5d8896a44de8_s390x as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-ovn-kubernetes@sha256:853844d93cdd51cb9560f3eb931393cfc2964c8e856e6fab242d7ab9ab6eebf1_amd64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-ovn-kubernetes@sha256:9d351388f4fe70fa45a4b03aeb9c4b669d3ce773a4fab5ba201a25a509841ecd_ppc64le as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-ovn-kubernetes@sha256:e9b7d3fa87821d1dcf558cb7c8bb75db4267382259ef08e1abb6830d787ce9fb_arm64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-vmware-vsphere-csi-driver-operator-rhel8@sha256:cff27ee456c08a68330e889b3b3c7b8d88c34ab00c3342aa2059c0bfeaf30881_amd64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
- Workaroundopenshift4/ose-vsphere-csi-driver-operator-rhel8@sha256:cff27ee456c08a68330e889b3b3c7b8d88c34ab00c3342aa2059c0bfeaf30881_amd64 as a component of Red Hat OpenShift Container Platform 4.10
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan