RHSA-2021:5086MediumCVSS 8.1

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update

Published
December 13, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (9)

CVE-2021-32803 →CVE-2021-33195 →CVE-2021-33197 →CVE-2021-33198 →CVE-2021-37701 →CVE-2021-37712 →CVE-2020-8565 →CVE-2021-32804 →CVE-2021-34558 →

📋 Description

CVE-2020-8565 — kubernetes: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9 CVE-2021-32803 — nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite CVE-2021-32804 — nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite CVE-2021-33195 — golang: net: lookup functions may return invalid host names CVE-2021-33197 — golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty CVE-2021-33198 — golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents CVE-2021-34558 — golang: crypto/tls: certificate of wrong type is causing TLS client to panic CVE-2021-37701 — nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite CVE-2021-37712 — nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite

🎯 Affected products46

  • Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf/odf-multicluster-rhel8-operator@sha256:17be1d705d7339f6e5f10d77c065c7a876c248c0913f625754443e58279c5039_ppc64le as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf/odf-multicluster-rhel8-operator@sha256:446de9c6969efa219fd09aca97e8f1d34a18aa5a1553cad93ea03d1c99d75e9d_amd64 as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf/odf-multicluster-rhel8-operator@sha256:80c5ca69a4a153fe862d2edc12910131b9edaf3dd4ad544c2a30d1e363bf4bdb_s390x as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/cephcsi-rhel8@sha256:6bb536ff91903016dcce91fcf6df30286321b7a415bcca68d22ca0a283406745_s390x as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/cephcsi-rhel8@sha256:7c3beaacde875028141485219de5c780c3c30b146bcc533dfe1eb6c562a65b95_amd64 as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/cephcsi-rhel8@sha256:f3b19e5732308b4d40f1b605169ac3f15a03194cb4dd47819ef073f36a0d1849_ppc64le as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/ocs-must-gather-rhel8@sha256:38d08ac83d988cda406d8cc6c2209ece706e125da07e202996f606c22c914349_s390x as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/ocs-must-gather-rhel8@sha256:b0211a2fdad8d5e6fdefeece952aa9c51598b74d74a12d5adec4bed4e2783b2d_amd64 as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/ocs-must-gather-rhel8@sha256:b1b008efb550c5fce0797378d96bb191a0c28aa15e813d759786e663fabb0274_ppc64le as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/ocs-operator-bundle@sha256:19baeee4a9db7519f1b88a885034be1e35423f34854323ac4a1b0e88e881bc3f_amd64 as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/ocs-operator-bundle@sha256:7507787d2c8f920c718c15b93e9c24f7edf8047a24c7c0c2024d70915d7ff1d2_ppc64le as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/ocs-operator-bundle@sha256:af844ee09da74a2bf95779de502b683982cfb54227f196f24ef07221af5ec9d8_s390x as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/ocs-rhel8-operator@sha256:1fe31ad232d5ffc1eb202db0f83eb882eeca1bde83ba282fe412485c5b2bc479_amd64 as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/ocs-rhel8-operator@sha256:355c50572c534973734eaeb171375bae9e0342504942b28585f5498829ae8aeb_ppc64le as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/ocs-rhel8-operator@sha256:b02b6d2cd44672787e0fa5569074c4a8cdcc6fde0206fe01ef6d9d70a6385d0c_s390x as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-console-rhel8@sha256:02777f2cd36c40d5c09a28116e24c1c7a8ee0c6030d680281e042d08e1fd61f6_ppc64le as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-console-rhel8@sha256:71724ee7baa629a98b4bf979e232dd128a313a2fa1eb4156c5b69593c99ec181_amd64 as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-console-rhel8@sha256:fd1659e10e099871d6a956bb26c3c17ed9a9bccc5ed90768514be8b0dcc34ff3_s390x as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-multicluster-operator-bundle@sha256:5a3e1458b856d295ba8fa9d075845d2524c6130d60db07b85cce99f5719a014f_amd64 as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-multicluster-operator-bundle@sha256:b66338b35316b95d01fc30a207fd80227c2cb0cbc06ee516230dbb4e2c2e369e_s390x as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-multicluster-operator-bundle@sha256:ee9641382dcfccd9db92c66bab549c0b44a218572e40011c2e22b651d4ff64af_ppc64le as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-multicluster-rhel8-operator@sha256:17be1d705d7339f6e5f10d77c065c7a876c248c0913f625754443e58279c5039_ppc64le as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-multicluster-rhel8-operator@sha256:446de9c6969efa219fd09aca97e8f1d34a18aa5a1553cad93ea03d1c99d75e9d_amd64 as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-multicluster-rhel8-operator@sha256:80c5ca69a4a153fe862d2edc12910131b9edaf3dd4ad544c2a30d1e363bf4bdb_s390x as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-operator-bundle@sha256:2231fc5ebf70c6165947bdc31f95b6deaa69f1efbd6c6194b457e2ad7bb10948_amd64 as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-operator-bundle@sha256:5d47bf5c8aaadc387d2bde705cfc3238436bd29547139e6ce82bb3c9512da7f4_ppc64le as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-operator-bundle@sha256:f51b12d4d34949b0932386e26af1c33db240d95a3e20b0ccdb469e4596124220_s390x as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-rhel8-operator@sha256:43679e013dacc86f5d181455fd533bc32a1d1b48e8cd2b0a88905c941127c09e_s390x as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • odf4/odf-rhel8-operator@sha256:bbfcc2e62edb26b19578242800bf654cd74efbb33ff81273d62e207deff15c13_amd64 as a component of Red Hat OpenShift Data Foundation 4.9 on RHEL-8
  • +16 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (108)