Red Hat Security Advisory: OpenShift Container Platform 3.11 security update
Red Hat OpenShift Container Platform release 3.11.200 is now available with updates to packages and images that fix several bugs. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-11100US | high8.8 | — | ||
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap v… | ||||
| CVE-2019-19330US | critical9.8 | — | ||
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, A… | ||||
| CVE-2019-18277US | high7.5 | — | ||
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact wa… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2020:1287self
- https://access.redhat.com/security/updates/classification/#criticalexternal
- 1759697external
- 1777584external
- 1819111external
- Canonical URLself
Behebungen (25)
- Behobenhaproxy-0:1.8.23-3.el7.src as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy-0:1.8.23-3.el7.src as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy-0:1.8.23-3.el7.src as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy-debuginfo-0:1.8.23-3.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy-debuginfo-0:1.8.23-3.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy-debuginfo-0:1.8.23-3.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy-debuginfo-0:1.8.23-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy-debuginfo-0:1.8.23-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy-debuginfo-0:1.8.23-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy18-0:1.8.23-3.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy18-0:1.8.23-3.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy18-0:1.8.23-3.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy18-0:1.8.23-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy18-0:1.8.23-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Behobenhaproxy18-0:1.8.23-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
Before applying this update, ensure all previously released errata relevant to your system is applied. See the following documentation, which will be updated shortly for release 3.11.200, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2020:1287 - Workaroundhaproxy-0:1.8.23-3.el7.src as a component of Red Hat OpenShift Container Platform 3.11
- Reconsider the use of `http-reuse always` if possible - Disable HTTP Keep-Alive (also called HTTP Connection reuse) in the backend - Fix the backend server to correctly parse Transfer-Encoding/Content-Length headers
- Workaroundhaproxy-0:1.8.23-3.el7.src as a component of Red Hat OpenShift Container Platform 3.11
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
- Workaroundhaproxy-debuginfo-0:1.8.23-3.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
- Reconsider the use of `http-reuse always` if possible - Disable HTTP Keep-Alive (also called HTTP Connection reuse) in the backend - Fix the backend server to correctly parse Transfer-Encoding/Content-Length headers
- Workaroundhaproxy-debuginfo-0:1.8.23-3.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
- Workaroundhaproxy-debuginfo-0:1.8.23-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
- Reconsider the use of `http-reuse always` if possible - Disable HTTP Keep-Alive (also called HTTP Connection reuse) in the backend - Fix the backend server to correctly parse Transfer-Encoding/Content-Length headers
- Workaroundhaproxy-debuginfo-0:1.8.23-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
- Workaroundhaproxy18-0:1.8.23-3.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
- Reconsider the use of `http-reuse always` if possible - Disable HTTP Keep-Alive (also called HTTP Connection reuse) in the backend - Fix the backend server to correctly parse Transfer-Encoding/Content-Length headers
- Workaroundhaproxy18-0:1.8.23-3.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
- Workaroundhaproxy18-0:1.8.23-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
- Reconsider the use of `http-reuse always` if possible - Disable HTTP Keep-Alive (also called HTTP Connection reuse) in the backend - Fix the backend server to correctly parse Transfer-Encoding/Content-Length headers
- Workaroundhaproxy18-0:1.8.23-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan