Sicherheit: Zwei Probleme in OpenShift
Aktuelle Meldungen Distributionen
Name: Zwei Probleme in OpenShift
ID: RHSA-2021:1005-01
Distribution: Red Hat
Plattformen: Red Hat OpenShift Enterprise
Datum: Di, 6. April 2021, 07:37
Referenzen: https://access.redhat.com/security/cve/CVE-2021-20206
Applikationen: OKD


Hash: SHA256

Red Hat Security Advisory

Synopsis: Moderate: OpenShift Container Platform 4.7.5 security and
bug fix update
Advisory ID: RHSA-2021:1005-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2021:1005
Issue date: 2021-04-05
CVE Names: CVE-2021-3121 CVE-2021-20206

1. Summary:

Red Hat OpenShift Container Platform release 4.7.5 is now available with
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.7.5. See the following advisory for the RPM packages for
this release:


All OpenShift Container Platform 4.7 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift Console
or the CLI oc command. Instructions for upgrading a cluster are available
- -between-minor.html#understanding-upgrade-channels_updating-cluster-between
- -minor

Security Fix(es):

* gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index
validation (CVE-2021-3121)

* containernetworking-cni: Arbitrary path injection via type field in CNI
configuration (CVE-2021-20206)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

This update also fixes several bugs. Documentation for these changes is
available from the Release Notes document linked to in the References

You may download the oc tool and use it to inspect release image metadata
as follows:

(For x86_64 architecture)

$ oc adm release info

The image digest is

(For s390x architecture)

$ oc adm release info

The image digest is

(For ppc64le architecture)

$ oc adm release info

The image digest is

3. Solution:

For OpenShift Container Platform 4.7 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:


Details on how to access this content are available at
- -cli.html.

4. Bugs fixed (https://bugzilla.redhat.com/):

1917904 - [release-4.7] bump k8s.io/apiserver to 1.20.3
1919391 - CVE-2021-20206 containernetworking-cni: Arbitrary path injection via
type field in CNI configuration
1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks
certain index validation
1925792 - "Edit Annotation" are not correctly translated in Chinese
1927198 - [e2e][automation] Fix pvc string in pvc.view
1927311 - Performance: Console makes unnecessary requests for en-US messages on
1927953 - [sig-network-edge][Conformance][Area:Networking][Feature:Router] The
HAProxy router should be able to connect to a service that is idled because a GET on the route will unidle it
1928151 - Manually misspelled as Manualy
1928614 - NTO may fail to disable stalld when relying on Tuned
'[service]' plugin
1929118 - Update plugins and Jenkins version to prepare openshift-sync-plugin
1.0.46 release
1929246 - Missing info for Operational Status, Provisioning status, BMC,
Hostname, ID for BMH for OCP deployed with assisted installer
1929674 - [sig-network] pods should successfully create sandboxes by getting
1931382 - Pipelines shown in edit flow for Workloads created via ContainerImage
1931520 - multicast traffic is not working on ovn-kubernetes
1931622 - LoadBalancer service check test fails during vsphere upgrade
1931856 - ServiceAccount Registry Authfiles Do Not Contain Entries for Public
1932268 - ovn-kubernetes endpoint slice controller doesn't run on CI jobs
1932272 - Items marked as mandatory in KMS Provider form are not enforced
1932277 - Create new pool with arbiter - wrong replica
1932806 - release-4.7: e2e: test OAuth API connections in the tests by that
1933205 - /usr/lib/dracut/modules.d/30ignition/ignition --version sigsev
1933665 - Getting Forbidden for image in a container template when creating a
sample app
1934442 - [release-4.7] Gather info about unhealthy SAP pods
1935070 - (release-4.7) Extend OLM operator gatherer to include
Operator/ClusterServiceVersion conditions
1935180 - [4.7z] IGMP/MLD packets being dropped
1935605 - [Backport 4.7] Add memory and uptime metadata to IO archive
1935672 - pipelinerun status icon rendering issue
1935707 - test: Detect when the master pool is still updating after upgrade
1936337 - console operator panics in DefaultDeployment with nil cm
1936802 - (release-4.7) Authentication log gatherer shouldn't scan all the
pod logs in the openshift-authentication namespace
1936975 - VSphereProblemDetectorControllerDegraded: context canceled during
upgrade to 4.7.0
1937089 - cluster DNS experiencing disruptions during cluster upgrade in
insights cluster
1937214 - Ingress operator performs spurious updates in response to API's
defaulting of NodePort service's clusterIPs field
1937356 - Incorrect imagestream is shown as selected in knative service
container image edit flow
1937375 - [release-4.7] When deploying the operator via OLM (after creating the
respective catalogsource), the deployment "lost" the `resources` section.
1938316 - [sig-instrumentation][Late] Alerts shouldn't report any alerts in
firing state apart from Watchdog and AlertmanagerReceiversNotConfigured: Prometheus query error
1938921 - Router HAProxy config file template is slow to render due to
repetitive regex compilations
1938960 - Permissive Egress NetworkPolicy ( is blocking all traffic
1939061 - [release-4.7] Sap license management logs gatherer 4.7
1939199 - move to go 1.15 and registry.ci.openshift.org
1939608 - FilterToolbar component does not handle 'null' value for
'rowFilters' prop
1940052 - Not all image pulls within OpenShift builds retry
1940806 - [4.7z] CNO: nodes and masters are upgrading simultaneously
1940866 - Add BareMetalPlatformType into e2e upgrade service unsupported list
1941128 - fix co upgradeableFalse status and reason
1941217 - Bare-metal operator is firing for ClusterOperatorDown for 15m during
4.6 to 4.7 upgrade
1941246 - Openshift-apiserver CO unavailable during cluster upgrade from 4.6 to
1941367 - The containerruntimecontroller doesn't roll back to CR-1 if we
delete CR-2
1941468 - (release-4.7) 'More about Insights' link points to support
1941574 - [sig-network-edge][Conformance][Area:Networking][Feature:Router] The
HAProxy router should be able to connect to a service that is idled because a GET on the route will unidle it [Suite:openshift/conformance/parallel/minimal]
1942059 - `oc adm catalog mirror` doesn't work for the air-gapped cluster
1942068 - [release-4.7] Gahter datahubs.installers.datahub.sap.com resources
from SAP clusters
1943310 - [SCALE] enable OVN DB memory trimming on compaction

5. References:


6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
Version: GnuPG v1


RHSA-announce mailing list
Pro-Linux @Facebook
Neue Nachrichten