Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.6.8 security and packages update

Red Hat OpenShift Container Platform release 4.6.8 is now available with updates to packages and images that fix several bugs. An update for ironic-images, openshift, openshift-ansible, openshift-clients, and python-eventlet, cri-o, openshift-kuryr, python-pyroute2 is now available for Red Hat...

RHEL 7 / 8 : OpenShift Container Platform 4.6.8 (RHSA-2020:5260)

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5260 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

Security Bulletin: IBM Cloud Transformation Advisor is affected by a vulnerability in WebSphere Application Server Liberty (CVE-2020-10693)

Summary IBM Cloud Transformation Advisor has addressed the following vulnerability: CVE-2020-10693 Vulnerability Details CVEID: CVE-2020-10693 DESCRIPTION: Hibernate Hibernate Validator could allow a remote attacker to bypass security restrictions, caused by a flaw in the message interpolation...

Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js vulnerability

Summary IBM Cloud Transformation Advisor has addressed the following vulnerability: CVE-2020-8277 Vulnerability Details CVEID: CVE-2020-8277 DESCRIPTION: Node.js is vulnerable to a denial of service. By getting the application to resolve a DNS record with a larger number of responses, an attacker...

Security Bulletin: IBM Cloud Transformation Advisor is affected by a vulnerability in WebSphere Application Server Liberty (CVE-2020-4590)

Summary IBM Cloud Transformation Advisor has addressed the following vulnerability. CVE-2020-4590 Vulnerability Details CVEID: CVE-2020-4590 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerable t...

CVE-2020-27833

A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image .tar file which contains symbolic links. The vulnerability is limited to the command oc image extract. If a symbolic link is first...

Red Hat Openshift-client Backlink Vulnerability

Red Hat Openshift-client is a Python-based package for interacting with the Openshift platform from Red Hat USA. A backlink vulnerability exists in openshift-clients that stems from openshift-client allowing tarball to create links outside of tarball's parent directory, allowing executables or...

Red Hat OpenShift cluster-ingress-operator security vulnerability

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that supports building, testing, deploying, and running applications. A security vulnerability exists in Red Hat Openshift cluster-ingress-operator, which stems from a change to the...

Low: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4.31 packages update

Red Hat OpenShift Container Platform release 4.4.31 is now available with updates to packages and images that fix several bugs. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This...

Design/Logic Flaw

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link kibana console to different one, created based on the new CR for the new kibana resource. This could lead to an...

CVE-2020-27816

The CVE-2020-27816 issue affects the elasticsearch-operator (container) prior to version 4.7, where the operator does not validate the namespace for kibana logging resources, enabling replacement of the openshift-logging console link and potential arbitrary URL redirection. Red Hat advisory RHSA-...

CVE-2020-27816

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link kibana console to different one, created based on the new CR for the new kibana resource. This could lead to an...

CVE-2020-27816

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link kibana console to different one, created based on the new CR for the new kibana resource. This could lead to an...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.5.21 bug fix and security update

Red Hat OpenShift Container Platform release 4.5.21 is now available with updates to packages and images that fix several bugs. This release includes a security update for openshift-enterprise-hyperkube for Red Hat OpenShift Container Platform 4.5.21. Red Hat Product Security has rated this updat...

Red Hat OpenShift Elasticsearch-operator Input Validation Error Vulnerability

Red Hat OpenShift Elasticsearch-operator is a software from Red Hat USA for use in OpenShift to support interaction with Elasticsearch. A security vulnerability exists in elasticsearch-operator-container versions prior to 4.7 that stems from not validating the namespace in which a kibana logging...

Low: Red Hat Security Advisory: OpenShift Container Platform 4.6.6 security update

An update for faq is now available for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

RHEL 8 : OpenShift Container Platform 4.6.6 (RHSA-2020:5159)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5159 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.5.20 bug fix and golang security update

Red Hat OpenShift Container Platform release 4.5.20 is now available with updates to packages and images that fix several bugs. This release includes a security update for golang for Red Hat OpenShift Container Platform 4.5. Red Hat Product Security has rated this update as having a security impa...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.5.20 packages and golang security update

Red Hat OpenShift Container Platform release 4.5.20 is now available with updates to packages and images that fix several bugs. This release also includes a security update for golang for Red Hat OpenShift Container Platform 4.5.20. Red Hat Product Security has rated this update as having a...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Jaeger security update

An update is now available for Red Hat OpenShift Jaeger 1.20. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...