RHSA-2021:1230HighCVSS 9.8

Red Hat Security Advisory: OpenShift Container Platform 4.6.26 security and extras update

Published
April 27, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (24)

CVE-2018-14721 →CVE-2020-35491 →CVE-2020-36180 →CVE-2020-36186 →CVE-2020-36188 →CVE-2018-14719 →CVE-2018-14720 →CVE-2018-19360 →CVE-2019-14379 →CVE-2020-24750 →CVE-2020-35728 →CVE-2020-36184 →CVE-2020-36185 →CVE-2018-19362 →CVE-2020-35490 →CVE-2020-36181 →CVE-2020-36182 →CVE-2020-36183 →CVE-2020-36187 →CVE-2020-36189 →CVE-2021-20190 →CVE-2020-36179 →CVE-2018-14718 →CVE-2018-19361 →

📋 Description

CVE-2018-14718 — jackson-databind: arbitrary code execution in slf4j-ext class CVE-2018-14719 — jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes CVE-2018-14720 — jackson-databind: exfiltration/XXE in some JDK classes CVE-2018-14721 — jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class CVE-2018-19360 — jackson-databind: improper polymorphic deserialization in axis2-transport-jms class CVE-2018-19361 — jackson-databind: improper polymorphic deserialization in openjpa class CVE-2018-19362 — jackson-databind: improper polymorphic deserialization in jboss-common-core class CVE-2019-14379 — jackson-databind: default typing mishandling leading to remote code execution CVE-2020-24750 — jackson-databind: Serialization gadgets in com.pastdev.httpcomponents.configuration.JndiConfiguration CVE-2020-35490 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource CVE-2020-35491 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource CVE-2020-35728 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool CVE-2020-36179 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS CVE-2020-36180 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS CVE-2020-36181 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS CVE-2020-36182 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS CVE-2020-36183 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool CVE-2020-36184 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource CVE-2020-36185 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource CVE-2020-36186 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource CVE-2020-36187 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource CVE-2020-36188 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource CVE-2020-36189 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource CVE-2021-20190 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to javax.swing

🎯 Affected products130

  • Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-ansible-operator@sha256:1bdf5505b33880666b5e98af98e2237702b7ba879684844cd0c867a6a4535752_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-ansible-operator@sha256:a065f31ff3d4583d5346dacfdb82fc1676ebc6a66c8ab6f91b5317b20bee2922_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-ansible-operator@sha256:e08c21810d029d1c44468e63a51da715540620b942bb258b4d46f266ba11adf2_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-capacity@sha256:757a8fc6c74fb58ee8e4342e0a01b6613b0db4bc5358f7a3bd7648357c1d2d2f_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-capacity@sha256:7c0735d650dbcd648c34decf07468a211a486a154353826e2d21c507bd9e09b1_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-capacity@sha256:a356b236981577ff562886ac80bbc94d5b3177b31a01e12a709fa8706f3a0bef_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-kube-descheduler-operator@sha256:085a4280161e972baf1c7117f5f3c2f85ec5f7a02aece451977cc0d40970e02c_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-kube-descheduler-operator@sha256:aee746eaf43c085f305c81ad840e9e93b93ae4c8d4f7d399104fa823a5854494_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-kube-descheduler-operator@sha256:f5abc71afc0108cc68d115f088da4a0f409c569b29af250da3071d2b09246c1a_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-kube-descheduler-rhel8-operator@sha256:085a4280161e972baf1c7117f5f3c2f85ec5f7a02aece451977cc0d40970e02c_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-kube-descheduler-rhel8-operator@sha256:aee746eaf43c085f305c81ad840e9e93b93ae4c8d4f7d399104fa823a5854494_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-kube-descheduler-rhel8-operator@sha256:f5abc71afc0108cc68d115f088da4a0f409c569b29af250da3071d2b09246c1a_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-logging-operator@sha256:56785d26ee764d5845daa0a40ed166d90899df92eda0a571244990a0198f90fb_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-logging-operator@sha256:6ac5fdc243dd9c9f394409b019c3e3f223f3a8988e92449722267a4ede3f71e5_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-logging-operator@sha256:b649cce6850bf161b93a5f6e46b160c5dd1f953b5c6b86962812a3d68c288c84_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-nfd-operator@sha256:3a8dd6b9d8ba07b7a7465624097ae5f96cb418b7eaf4d7f20d67051eb43f24c3_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-nfd-operator@sha256:44261c4897b6cb25e540a29d9a7e0255e09077897349f253a341c2a62bc40b57_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cluster-nfd-operator@sha256:70c6f5a0b4024fb47ea18454d79a550cd3bef22371954dbfa88996c56bc54fbc_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:36810ff04906b074fe509d744b121c05c58e7b3065cad7e6c31c61cb5e5bf827_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:ca1d1b3e37ba0902750b55aabc3243699ab700d4808bf7da0d409b6ab536f5be_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:f93a04e4d827f2a403ec5cf42883b39eeca85bc836793c22ec8e85f6b6655d7f_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-clusterresourceoverride-rhel8@sha256:3e58d28b4ff0eea028d80f10d182e0d131105215e47ba2460d7d387fc3589fb1_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-clusterresourceoverride-rhel8@sha256:3f90d6cc032e068c41fa90abe60a39bea595a77c07c6b6fe1e5bbe26142d1d66_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-clusterresourceoverride-rhel8@sha256:e03bbf11d2142e7d8090993de9934fc13fee4c583e0d05079c8b7550d7fe7bff_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-descheduler@sha256:4d73f8db16aac6881680b4c7ee49449f2cc9a79d536ce6ffda4621abb45f2bdb_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-descheduler@sha256:8b069b2c625c6c8281bdbd7e957f48d0e1407c9087a9277cf2c176daf4564c25_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-descheduler@sha256:ce14ed3c5e3a6b5ccf42feea4d5895150586d12e30ed42496809cc94ea7fabb6_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-egress-dns-proxy@sha256:515d077af11b0769686a97d6796a115c4a177d1986da9f584a1e3a3c0e9584f6_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-egress-dns-proxy@sha256:6a090568a5cf1d9fa225e67f37b0e11243764f35c922b1fcc3a62cdbe83c56d7_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • +100 more not shown

✅ Remediation

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.6.26. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHBA-2021:1232 All OpenShift Container Platform 4.6 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-between-minor.html#understanding-upgrade-channels_updating-cluster-between-minor For OpenShift Container Platform 4.6 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid com.pastdev.httpcomponents in the classpath Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and org.apache.commons.dbcp2.datasources.SharedPoolDataSource in the classpath Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool in the classpath Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid: oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource, com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource, com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource in the classpath Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid javax.swing in the classpath

🔗 References (30)