Synopsis

Moderate: OpenShift Container Platform 4.2.22 skopeo security update

Type/Severity

Security Advisory: Moderate

Topic

An update for skopeo is now available for Red Hat OpenShift Container Platform 4.2.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

• proglottis/gpgme: Use-after-free vulnerability was found in GPGME bindings during container image pull (CVE-2020-8945)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For OpenShift Container Platform 4.2 see the following documentation, which
will be updated shortly for release 4.2.22, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.2/release_notes/ocp-4-2-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.2/updating/updating-cluster-cli.html.

Affected Products

• Red Hat OpenShift Container Platform 4.2 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.2 for RHEL 8 s390x

Fixes

• BZ - 1795838 - CVE-2020-8945 proglottis/gpgme: Use-after-free in GPGME bindings during container image pull

CVEs

• CVE-2020-8945

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat OpenShift Container Platform 4.2 for RHEL 8

SRPM
skopeo-0.1.32-7.git1715c90.rhaos4.2.el8.src.rpm	SHA-256: f1a923c15cbcae1f8c3bdeaf7b45779f3600b92711e193a25325899e680654cc
x86_64
containers-common-0.1.32-7.git1715c90.rhaos4.2.el8.x86_64.rpm	SHA-256: 2632547d7e7266c709177347606164bbe2a03ec48e724cd16aed0b2beebd9bb5
skopeo-0.1.32-7.git1715c90.rhaos4.2.el8.x86_64.rpm	SHA-256: c379ec2243cff6f120f1625c8f7e4016a0e90504f345e35315321e880f4b7497
skopeo-debuginfo-0.1.32-7.git1715c90.rhaos4.2.el8.x86_64.rpm	SHA-256: 4ca6f3bb67abef04284ccc481b3d03bd6d6410bf83afcebb8f19c335ee30de49
skopeo-debugsource-0.1.32-7.git1715c90.rhaos4.2.el8.x86_64.rpm	SHA-256: 747cd4d26a4eb364e750e2aa8baf91c2e8569612650488272ca63a4865304a68

Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.2 for RHEL 8

SRPM
skopeo-0.1.32-7.git1715c90.rhaos4.2.el8.src.rpm	SHA-256: f1a923c15cbcae1f8c3bdeaf7b45779f3600b92711e193a25325899e680654cc
s390x
containers-common-0.1.32-7.git1715c90.rhaos4.2.el8.s390x.rpm	SHA-256: a2611a3442906ac9652bddec4a0ead7296dc1fd5add0510e049d19c3899ff9f7
skopeo-0.1.32-7.git1715c90.rhaos4.2.el8.s390x.rpm	SHA-256: 88f96dd7c4bd3575c1c75f0e09703a6c8f862316dea771bf3b8d79e381f61eee
skopeo-debuginfo-0.1.32-7.git1715c90.rhaos4.2.el8.s390x.rpm	SHA-256: 5297b2a8605cfcbf1ca52cc80df9b0f7a5c0ded66e4a2057d12fae2e99e47cb6
skopeo-debugsource-0.1.32-7.git1715c90.rhaos4.2.el8.s390x.rpm	SHA-256: 5fc73a3fbb5deb76d5d6cafc4ff863d62dc51963837723fb4f8e4bad14168357