-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: OpenShift Container Platform 4.4.11
 grafana-container security update
Advisory ID:       RHSA-2020:2792-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:2792
Issue date:        2020-07-06
CVE Names:         CVE-2020-13379 
=====================================================================

1. Summary:

An update for grafana-container is now available for Red Hat OpenShift
Container Platform 4.4.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

* grafana: SSRF incorrect access control vulnerability allowed
unauthenticated users to make grafana send HTTP requests to any URL
(CVE-2020-13379)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 4.4 see the following documentation, which
will be updated shortly for release 4.4.11, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-rel
ease-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.4/updating/updating-cluster
- -cli.html.

4. Bugs fixed (https://bugzilla.redhat.com/):

1843640 - CVE-2020-13379 grafana: SSRF incorrect access control vulnerability
 allows unauthenticated users to make grafana send HTTP requests to any URL

5. References:

https://access.redhat.com/security/cve/CVE-2020-13379
https://access.redhat.com/security/updates/classification/#moderate

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXwOF3tzjgjWX9erEAQjwdA/+Mwdsy9r6rVrtdiiuMmnfvJit7B7LhI0F
Req1aEJztUDsWZe1WXeSclij2bi+qhGFXdtsI6lzD9uSUtdiaHUmRxi3GGFEKz8d
52HVSuEH65h3VN/oP3p3ngsL8G8FpL8G1/eqCXgctaVYkWM3H6R1ZQTyRXaHEsZ+
2QqDab++taP5tpciVMIWXKAY2uqCZGQO5+tFi7NgYQrNEscEFHLmH3P+wzACB7Si
Fl0qZ7QNGSw9vzb0yVyiPhqRs1HlQcSxneBOqyDNOKIO/vf5cRRODvc2PcngRMiJ
xwnH21FfOcKyAeVlirg0noUNadAQe6zC/El5iGSZ34aXKsiY8hwSdHMAsNxUhHP8
zxLXVWbSoktRJiMc+biAHIokGmb7Yek+EZIht7ZlxhAnZ0JpTn9bSjtmRG6mGK4O
qCu3V3gmJyx2MZlMJ+DwodxOIYAUV3pZ6x+7cw9XjTyWV1SDbWfTUCXyITaqBZXQ
9deHO0Nqcy8AaeIHH9oa3Eaawgoz1q2Rii6lsomK9NVQxh49h6yuK8WOmbgw2SOh
uZsgHFh+IIfpkUuvob6AVFHd90LGAsOSZdmIbw5x1/JaEcndaQ58PBX2CYPCOMn4
oK4Dugys4OhqdXvJJOzzfnId/JjFTdKsNTgH2oque+fOAwuZXaHEHMP5UjHH4Xki
pnXIvTfwpWk=
=R6Br
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce