RHSA-2020:2479MediumCVSS 6.5

Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update

Published
June 18, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (3)

CVE-2020-8555 →CVE-2017-18367 →CVE-2019-11254 →

📋 Description

CVE-2017-18367 — libseccomp-golang: mishandling of multiple argument rules leading to a bypass of intended access restrictions CVE-2019-11254 — kubernetes: Denial of service in API server via crafted YAML payloads by authorized users CVE-2020-8555 — kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information

🎯 Affected products25

  • Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.src as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-clients-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-clients-redistributable-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-docker-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-excluder-0:3.11.232-1.git.0.a5bc32f.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-hyperkube-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-hypershift-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-master-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-node-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-pod-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-sdn-ovs-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-template-service-broker-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • atomic-openshift-tests-0:3.11.232-1.git.0.a5bc32f.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11

✅ Remediation

See the following documentation, which will be updated shortly for release 3.11.232, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258. Workaround: Prevent unauthenticated or unauthorized access to the API server Workaround: Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC

🔗 References (6)