RHSA-2021:0145MediumCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Serverless Client kn 1.12.0

Published
January 14, 2021
Last Modified
November 5, 2026

🔗 CVE IDs covered (4)

CVE-2020-28366 →CVE-2020-28367 →CVE-2020-24553 →CVE-2020-28362 →

📋 Description

CVE-2020-24553 — golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS CVE-2020-28362 — golang: math/big: panic during recursive division of very large numbers CVE-2020-28366 — golang: malicious symbol names can lead to code execution at build time CVE-2020-28367 — golang: improper validation of cgo flags can lead to code execution at build time

🎯 Affected products3

  • Red Hat OpenShift Serverless 1.0
  • openshift-serverless-clients-0:0.18.4-2.el8.src as a component of Red Hat OpenShift Serverless 1.0
  • openshift-serverless-clients-0:0.18.4-2.el8.x86_64 as a component of Red Hat OpenShift Serverless 1.0

✅ Remediation

See the documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless_applications/index Workaround: If it's possible to confirm that the Go project being built does not rely on any cgo code in the included dependencies, the env variable CGO_ENABLED=0 can be specified when using either `go get` or `go build`. For example: CGO_ENABLED=0 go get github.com/someproject This will not stop the files being downloaded but will stop any automatic complication of the cgo code, including inlined in the go file and separate .c files. Of course, this will only be effective if cgo is not relied upon in a given dependency and may not be appropriate in all scenarios. Workaround: If it's possible to confirm that the go project being built does not rely on any cgo code in the included dependencies, the env variable CGO_ENABLED=0 can be specified when using either `go get` or `go build`. For example: CGO_ENABLED=0 go get github.com/someproject This will not stop the files being downloaded but will stop any automatic complication of the cgo code, including inlined in the go file and separate .c files. Of course, this will only be effective if cgo is not relied upon in a given dependency and may not be appropriate in all scenarios.

🔗 References (9)