drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in Red Hat OpenShift Service Mesh
Name: |
Mehrere Probleme in Red Hat OpenShift Service Mesh |
|
ID: |
RHSA-2020:0734-01 |
|
Distribution: |
Red Hat |
|
Plattformen: |
Red Hat OpenShift Service Mesh |
|
Datum: |
Do, 5. März 2020, 23:52 |
|
Referenzen: |
https://access.redhat.com/security/cve/CVE-2020-8659
https://access.redhat.com/security/cve/CVE-2020-8664
https://access.redhat.com/security/cve/CVE-2020-8661
https://access.redhat.com/security/cve/CVE-2020-8660 |
|
Applikationen: |
Red Hat OpenShift Service Mesh |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: Red Hat OpenShift Service Mesh 1.0.9 servicemesh-proxy security update Advisory ID: RHSA-2020:0734-01 Product: Red Hat OpenShift Service Mesh Advisory URL: https://access.redhat.com/errata/RHSA-2020:0734 Issue date: 2020-03-05 CVE Names: CVE-2020-8659 CVE-2020-8660 CVE-2020-8661 CVE-2020-8664 =====================================================================
1. Summary:
Red Hat OpenShift Service Mesh 1.0.9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
2. Relevant releases/architectures:
OpenShift Service Mesh 1.0 - x86_64
3. Description:
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
Security Fix(es):
* envoy: Excessive CPU and/or memory usage when proxying HTTP/1.1 (CVE-2020-8659)
* envoy: TLS inspector bypassc (CVE-2020-8660)
* envoy: Response flooding for HTTP/1.1 (CVE-2020-8661)
* envoy: Incorrect Access Control when using SDS with Combined Validation Context (CVE-2020-8664)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
4. Solution:
The OpenShift Service Mesh release notes provide information on the features and known issues:
https://docs.openshift.com/container-platform/4.3/service_mesh/servicemesh- release-notes.html
5. Bugs fixed (https://bugzilla.redhat.com/):
1802539 - CVE-2020-8659 envoy: Excessive CPU and/or memory usage when proxying HTTP/1.1 1802540 - CVE-2020-8661 envoy: Response flooding for HTTP/1.1 1802542 - CVE-2020-8664 envoy: Incorrect Access Control when using SDS with Combined Validation Context 1802545 - CVE-2020-8660 envoy: TLS inspector bypassc
6. Package List:
OpenShift Service Mesh 1.0:
Source: servicemesh-proxy-1.0.9-2.el8.src.rpm
x86_64: servicemesh-proxy-1.0.9-2.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2020-8659 https://access.redhat.com/security/cve/CVE-2020-8660 https://access.redhat.com/security/cve/CVE-2020-8661 https://access.redhat.com/security/cve/CVE-2020-8664 https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBXmFMc9zjgjWX9erEAQh5RxAAgCnYM0L0+b2PgDeANzdtC4yRqzkwBkjR uUSF5cWNzK0pSywGDc4u5hTv3ZBvMDCV1bFazKEtQuBqiQMBZtEHD3XNN7//HZov jYxn9Tj/tv7E/9S2Lge3hPTNlYAo6ryI+DdlsZ/0hc+SRqeQYSc0sLx+QN+kJcsU Fz3fdOG36tsHx6fekn0GyEFRsNsPTCP7k7dlT9AQXMSUpP3YtJQ2fm/zjEZqbtVh lt4FzOJSFuPeSy7ZTZpVGU0Ad4ummcyI8/YB/mA2jMthOpiR1N9F/aH5vMWf+q4e 0JH9KL5jh7aKsL4oqMyDM0n4AIVqxhz2Iks9z04bJKEELF1XiNmDLtxfQnh8e3Th KV8JpR/+M8efAQ1HtNQf/5CqG7ZJvBEpk4HQCLbaXQo5URWoccAgIsVieMQIWrA4 rOmx/KVLDqnJiak/kI1b6sV9tMJorkJv2B1eKylMJyj+1e04Xa1n2V2sC/E+42tY ALxdYlMxxHNNyF0TpNEDLlXtFr4SLL7Id4mtnDpKdFi5Vz/q3EwzA5G/seqFttjF bRRrCWWj36jxDsFMxkTWeqh9lclo2AmGz29cV9oDNntXnuwTozowKijyT0xKNyOr Oi3Ic7poIirR9NIJFgbOkSXShdPa/pctJVmVzAyIElp4jANgAGOXW5LTRBijnEzO fxoJqGuD7G0= =9SJw -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce
|
|
|
|