RHSA-2020:3727MediumCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 3.11.286 security update

Published
September 16, 2020
Last Modified
August 15, 2026

🔗 CVE IDs covered (2)

CVE-2020-10743 →CVE-2020-14040 →

📋 Description

CVE-2020-10743 — kibana: X-Frame-Option not set by default might lead to clickjacking CVE-2020-14040 — golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

🎯 Affected products5

  • Red Hat OpenShift Container Platform 3.11
  • openshift3/ose-docker-registry@sha256:2b58d801f83a732b121c74eedee3849c2137a1a534f5737483652b25f1fc66ec_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/ose-docker-registry@sha256:e01939c1a1721db529b079dc80d0db7432adc96bb71678817dc688d927a9d4d7_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/ose-logging-kibana5@sha256:65924e84fff7fc4ace75f00b823f3412af4936066a641849aa4b3c845b25c698_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/ose-logging-kibana5@sha256:db7cd31fd03986589b2e3e618aee85edc2383f56a9ee47c175e858f99d641f78_amd64 as a component of Red Hat OpenShift Container Platform 3.11

✅ Remediation

See the following documentation, which will be updated shortly for release 3.11.286, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258. Workaround: Any Kibana version with this commit [1] can add the following configuration option to mitigation the problem: config/kibana.yml: server.customResponseHeaders: {"x-frame-options":"deny"} or server.customResponseHeaders: {"x-frame-options":"sameorigin"} [1] https://github.com/elastic/kibana/pull/13045

🔗 References (5)