SUSE-SU-2020:3760-1 Security changes in Kubernetes, etcd, and helm; Bugfix in cri-o package

= Required Actions == Kubernetes & etcd Security fixes This fix involves an upgrade of Kubernetes and some add-ons. See https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/clusterupdates.htmlupdatingkubernetescomponents for the upgrade procedure. == Skuba & helm/helm3 In order to updat...

Announcing the General Availability of Container Security in the VMware Carbon Black Cloud

Today, we are excited to announce the first release of Container Security capabilities in the Carbon Black Cloud. Building on our Cloud Workload Protection solution announced at VMworld, our new Container Security offering supports VMware’s Intrinsic Security vision to protect data and applicatio...

Vulnerability found in Kubernetes

A vulnerability has been found in Kubernetes that allows a malicious person capable of performing a man-in-the-middle attack on the traffic within a cluster. By advertising an external IP address or by claiming a load balancer IP, traffic can be redirected to the attacker. However, the malicious...

RHEL 8 : OpenShift Container Platform 4.6.9 (RHSA-2020:5615)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5615 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.6.9 security and bug fix update

Red Hat OpenShift Container Platform release 4.6.9 is now available with updates to packages and images that fix several bugs and add enhancements. This release also includes a security update for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.6.9 packages and security update

Red Hat OpenShift Container Platform release 4.6.9 is now available with updates to packages and images that fix several bugs. This release includes a security update for openshift-clients, openvswitch2.13, and python-sushy, which are now available for Red Hat OpenShift Container Platform 4.6. Re...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2020–15257)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in containerd that could allow containers running in the host network namespace as root UID 0 to gain the host root privileges CVE-2020–15257 Vulnerability Details CVEID: CVE-2020-15257 Description: Containerd could allo...

RHEL 7 : OpenShift Container Platform 3.11.346 (RHSA-2020:5363)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5363 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

kubernetes: improper validation of URL redirection in the Kubernetes API server allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificat...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 3.11.346 security and bug fix update

Red Hat OpenShift Container Platform release 3.11.346 is now available with updates to packages and images that fix several bugs. This release includes a security update for Kubernetes for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a securi...

kubernetes: compromised node could escalate to cluster level privileges

A flaw was found in the Kubernetes API server, where it allows an attacker to escalate their privileges from a compromised node. This flaw allows an attacker who can intercept requests on a compromised node, to redirect those requests, along with their credentials, to perform actions on other...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.5.23 security and bug fix update

Red Hat OpenShift Container Platform release 4.5.23 is now available with updates to packages and images that fix several bugs. This release includes a security update for Kubernetes for Red Hat OpenShift Container Platform 4.5. Red Hat Product Security has rated this update as having a security...

Low: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.5.23 packages update

Red Hat OpenShift Container Platform release 4.5.23 is now available with updates to packages and images that fix several bugs. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.6.8 security and bug fix update

Red Hat OpenShift Container Platform release 4.6.8 is now available with updates to packages and images that fix several bugs. This release includes a security update for openshift-enterprise-builder-container for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.6.8 security and packages update

Red Hat OpenShift Container Platform release 4.6.8 is now available with updates to packages and images that fix several bugs. An update for ironic-images, openshift, openshift-ansible, openshift-clients, and python-eventlet, cri-o, openshift-kuryr, python-pyroute2 is now available for Red Hat...

SUSE SLES15 Security Update : Security changes in Kubernetes, etcd, / helm; Bugfix in cri-o package (SUSE-SU-2020:3760-1)

= Required Actions == Kubernetes & etcd Security fixes This fix involves an upgrade of Kubernetes and some add-ons. See https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/cluste rupd ates.htmlupdatingkubernetescomponents for the upgrade procedure. == Skuba & helm/helm3 In order to...

RHEL 7 / 8 : OpenShift Container Platform 4.6.8 (RHSA-2020:5260)

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5260 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

Security Bulletin: Open Source Security issues for NPS service provider

Summary Fixed OSS issue for listed CVE Vulnerability Details CVEID: CVE-2019-11253 DESCRIPTION: The Kubernetes API server is vulnerable to a denial of service, caused by a billion laughs attack, caused by an error when parsing YAML manifests. A remote attacker could exploit this vulnerability to...

Security Bulletin: Open Source Secuity issues fixed for NPS softlayer provisioner.

Summary Fixed OSS issus for listed CVEs. Vulnerability Details CVEID: CVE-2020-7919 DESCRIPTION: Go is vulnerable to a denial of service. By sending a malformed X.509 certificate, a remote attacker could exploit this vulnerability to cause a system panic. CVSS Base score: 7.5 CVSS Temporal Score:...

NICER Protocol Deep Dive: Internet Exposure of etcd

Welcome to the NICER Protocol Deep Dive blog series! When we started researching what all was out on the internet way back in January, we had no idea we'd end up with a hefty, 137-page tome of a research report. The sheer length of such a thing might put off folks who might otherwise learn a thin...