RHBA-2020:2409HighCVSS 8.8

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.5 image release advisory

Published
July 13, 2020
Last Modified
October 31, 2026

🔗 CVE IDs covered (21)

CVE-2020-2101 →CVE-2020-2134 →CVE-2020-9283 →CVE-2019-16538 →CVE-2020-2100 →CVE-2020-2110 →CVE-2020-10712 →CVE-2020-2105 →CVE-2020-2135 →CVE-2020-8551 →CVE-2020-8555 →CVE-2020-10749 →CVE-2020-11100 →CVE-2020-2102 →CVE-2020-2103 →CVE-2020-2104 →CVE-2020-2109 →CVE-2020-2111 →CVE-2020-2136 →CVE-2020-8945 →CVE-2020-2099 →

📋 Description

CVE-2019-16538 — jenkins-script-security-plugin: sandbox protection bypass leads to execute arbitrary code in sandboxed scripts CVE-2020-2099 — jenkins: Inbound TCP Agent Protocol/3 authentication bypass CVE-2020-2100 — jenkins: UDP multicast/broadcast service amplification reflection attack CVE-2020-2101 — jenkins: Non-constant time comparison of inbound TCP agent connection secret CVE-2020-2102 — jenkins: Non-constant time HMAC comparison CVE-2020-2103 — jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page CVE-2020-2104 — jenkins: Memory usage graphs accessible to anyone with Overall/Read CVE-2020-2105 — jenkins: REST APIs vulnerable to clickjacking CVE-2020-2109 — jenkins-pipeline-groovy-plugin: sandbox protection bypass through default parameter expressions in CPS-transformed methods CVE-2020-2110 — jenkins-script-security-plugin: sandbox protection bypass during script compilation phase by applying AST transforming annotations CVE-2020-2111 — jenkins-subversion-plugin: XSS in project repository base url CVE-2020-2134 — jenkins-script-security-plugin: sandbox protection bypass via crafted constructor calls and crafted constructor bodies CVE-2020-2135 — jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution CVE-2020-2136 — jenkins-git-plugin: stored cross-site scripting CVE-2020-8551 — kubernetes: crafted requests to kubelet API allow for memory exhaustion CVE-2020-8555 — kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information CVE-2020-8945 — proglottis/gpgme: Use-after-free in GPGME bindings during container image pull CVE-2020-9283 — golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic CVE-2020-10712 — openshift/cluster-image-registry-operator: secrets disclosed in logs CVE-2020-10749 — containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters CVE-2020-11100 — haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes

🎯 Affected products78

  • Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-aws-machine-controllers@sha256:7d29cf4dc690bfee58b9247bc7e67210ce9634139b15ce2bd56fbe905b246c83_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-azure-machine-controllers@sha256:edb3b90da9ff0fa55dd878d7660fc0846df22dbd0e85708e3131430f051bed89_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-baremetal-machine-controllers@sha256:a8df2fab0063f0b6367fad4e7d85d7b702d826677a3291cf24b7b749943c501c_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cli-artifacts@sha256:af06b5e2150f08dcc1904500e05d3aa730baf50d9888d7637b86fb0ef43ef159_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cli@sha256:b93a3f13057991466caf3ba6517493015299a856c6b752bd49b7d4c294312177_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cloud-credential-operator@sha256:7768af870ecb251e6c74ca6298ece3e7ea11fb154565cf41bca137061927c58d_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-authentication-operator@sha256:6200da75e6b80fab637c2dc765f69c8ba40aa5dfb42d20610b913651136e03ba_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-autoscaler-operator@sha256:dc1ad750397273b169ecfe68baac4e42db0333908057a31c48217677bfca87c9_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-autoscaler@sha256:a892fb19168f68a35912a7c67d1b0d41e487fadb120fa8cd4317ae95b23298c5_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-bootstrap@sha256:05416a5c4c45177233753e4912f3dfc6f3d6bca47455286cd4d08769825083d4_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-config-operator@sha256:b8ba4b92f04d9e4ff57516e6f70ebcf5bafe0a51c888062ab405f32c7381eedd_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-dns-operator@sha256:eea7d89790cf1c9eb9e22cc4a247a674f0721fededdc905d4c533ff57974dacb_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-image-registry-operator@sha256:a2912743f134109d5e0aece49db6d59e20aa8878142dc9de818e23deed707f38_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-ingress-operator@sha256:4a5256cdb4689b6358a21bcf970a024de307554a43a4a34027fba7ec8768d21c_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-kube-apiserver-operator@sha256:414aed0e6aace1a47945e9de709f3e16c96ec80275775f0c08d22425569bce56_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-kube-controller-manager-operator@sha256:759afff8ce10e2224c2a41272a3da78c782c294d0cc2624d63c4e466de597913_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-kube-scheduler-operator@sha256:b09d76b13ee2c6a766098483d6a4abe0946178dddb9c3b65b27ccd7be8fe7bd3_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-monitoring-operator@sha256:434ce55c0306215fc3067f1565f9f14cb60be8cdffc30dd54ff86d35c41a6418_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-network-operator@sha256:e9aea1c7c70b70257f10cb34f359162fcbd8007615e5fea5eb5935b2781e3c14_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-node-tuning-operator@sha256:5c3ece498eaf33fec8c616437763ad64e8ec278f9bab368b86a9525885420994_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-openshift-apiserver-operator@sha256:1f075c767d06eac44cf477aadb7ca0421af4778ca0b20885cc1eb071101d073a_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-openshift-controller-manager-operator@sha256:acc93fac7bf822a5d77cb1c640d899bad35c7106923ec0fd715858beb6c92ef6_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-samples-operator@sha256:3730e93274a5a0350e222dfc161bc4f5fb97e53e0672ec907888bceda4abb89b_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-storage-operator@sha256:f2a634b4207229b14da873dcd9c5a36f79701c2d410cee55bcdd46e8f7e7dca6_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-svcat-apiserver-operator@sha256:d6de058aca970acbff2530afd8f617a06200cf65cac4775b3219fc33b1a47842_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-update-keys@sha256:db0f41b3e4ea84a200135a2c810fe60ce0b9e35efff50249914381b76c56050f_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-cluster-version-operator@sha256:9c4a22bed1c7ef3847cf66d83349295dd6dcf402673c115d2957d56909b38c6e_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-configmap-reloader@sha256:8e18c6d3dca4ff8c6c7bc60ee5ac2a41d153c0567f58ec1ca71200e742eff635_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • openshift4/ose-console-operator@sha256:348b6648639f79f3ae83aa5441d1c1934974df0d4a0bea3d1dc035c2b85b4ec4_amd64 as a component of Red Hat OpenShift Container Platform 4.5
  • +48 more not shown

✅ Remediation

For OpenShift Container Platform 4.5 see the following documentation, which will be updated shortly for release 4.5.1, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html Workaround: Prevent unauthenticated or unauthorized access to the Kubelet API Workaround: Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC Workaround: Ensure that the image registry operator logs remain private. Workaround: Prevent untrusted, non-privileged containers from running with CAP_NET_RAW. Workaround: This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

🔗 References (1899)