RHSA-2021:2021MediumCVSS 7.5

Red Hat Security Advisory: Release of OpenShift Serverless 1.10.2 security update

Published
May 19, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2021-3114 →CVE-2021-3115 →

📋 Description

CVE-2021-3114 — golang: crypto/elliptic: incorrect operations on the P-224 curve CVE-2021-3115 — golang: cmd/go: packages using cgo can cause arbitrary code execution at build time

🎯 Affected products16

  • Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/client-kn-rhel8@sha256:8a19fe99f142033ab66b80c4714a0f52bd3c91965b7694745fc61219d84661da_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/ingress-rhel8-operator@sha256:f12e9371cdd87cd06ceff6311c655d3ac49c08d30f7d3b8ef1a4d8153df465ac_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/kn-cli-artifacts-rhel8@sha256:7c25cbb5a38690e026b65000c0fe9f7a998422e44783ad69d7270016be951ed7_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/knative-rhel8-operator@sha256:1e1d67c36891eb3047518c283fd65d188eb0d46f64724c4f9ff40640a762e2bc_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/kourier-control-rhel8@sha256:439fcdf6b34fc89e97c4a548986db74b31ec4d19ffb983e2d583c72c185bc7ad_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/serverless-operator-bundle@sha256:c7ae914f498df12fae7e2b4ceed55ccea5047af7e0328ca480c8ec898d2e0d90_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/serverless-rhel8-operator@sha256:e816fc9e4192441e3a4a1ae75f7113bbe378886d979e33bce6431873d8ee55b3_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/serving-activator-rhel8@sha256:77ca9f0ae7670f0d86d28b8f1119e3e4ac2f0cd90d1b2df89cf172bcd6a33f1f_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/serving-autoscaler-hpa-rhel8@sha256:b01d755483ec426d20ea60b516f2ba7cecc6e871cb01157890f66d80ead2e0b4_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/serving-autoscaler-rhel8@sha256:9422ac8583fcd60ce99acd8ed2c647b110a11d0e09a482efa4d07a1a38f1bb23_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/serving-controller-rhel8@sha256:e13ae5a93bbaf4c9f43bfb08cd502fe3aa47dedbea9afa8146252a44da547928_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/serving-queue-rhel8@sha256:a0d2c27d9d33d71d22076bda92f4c5db18d936952fb4f9f1cb2f4ac17b1d458d_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/serving-storage-version-migration-rhel8@sha256:acf2efcb3a7d6bf45257c66286c0579f2e4f504fcf80bc2b61edcb14964a0499_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/serving-webhook-rhel8@sha256:0aad9bf7220cd6fd3d6981d66034ac41be2a3cf2e01ccf7867ff19367d7e1aac_amd64 as a component of Red Hat OpenShift Serverless 1.10
  • openshift-serverless-1/svls-must-gather-rhel8@sha256:31896863edfb4cbb579635d470895607af09b33086ab2c59aca0f5266327ebda_amd64 as a component of Red Hat OpenShift Serverless 1.10

✅ Remediation

See the documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.5/html/serverless_applications/index Workaround: The flaw can be mitigated by making sure "." is not in your PATH environment variable.

🔗 References (6)