Issued:
2020-11-24
Updated:
2020-11-24

RHSA-2020:5119 - Security Advisory

Synopsis

Moderate: OpenShift Container Platform 4.5.20 packages and golang security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Red Hat OpenShift Container Platform release 4.5.20 is now available with updates to packages and images that fix several bugs.

This release also includes a security update for golang for Red Hat OpenShift Container Platform 4.5.20.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

Security Fix(es):

  • golang: Data race in certain net/http servers including ReverseProxy can lead to DoS (CVE-2020-15586)
  • golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (CVE-2020-16845)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.5.20. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHSA-2020:5118

All OpenShift Container Platform 4.5 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.[y]/updating/updating-cluster-between-minor.html#understanding-upgrade-channels_updating-cluster-between-minor.

Solution

For OpenShift Container Platform 4.5 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.

Affected Products

  • Red Hat OpenShift Container Platform 4.5 for RHEL 8 x86_64
  • Red Hat OpenShift Container Platform 4.5 for RHEL 7 x86_64
  • Red Hat OpenShift Container Platform for Power 4.5 for RHEL 8 ppc64le
  • Red Hat OpenShift Container Platform for Power 4.5 for RHEL 7 ppc64le
  • Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.5 for RHEL 8 s390x
  • Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.5 for RHEL 7 s390x

Fixes

  • BZ - 1856953 - CVE-2020-15586 golang: data race in certain net/http servers including ReverseProxy can lead to DoS
  • BZ - 1867099 - CVE-2020-16845 golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs
  • BZ - 1897972 - Placeholder bug for OCP 4.5.z rpm release

Red Hat OpenShift Container Platform 4.5 for RHEL 8

SRPM
cri-o-1.18.4-4.rhaos4.5.git6dee389.el8.src.rpm SHA-256: 2369ebde5452931b1a13c9efe790ce207e96670ad0f5d416dbf2b3df269bcde2
openshift-4.5.0-202011131403.p0.git.0.d153f8f.el8.src.rpm SHA-256: 6e7eb892cbc0db1387b2641db202a089a1acf725631b2172cd1c0952be8dc08e
openshift-clients-4.5.0-202011121956.p0.git.3609.b4952c1.el8.src.rpm SHA-256: 5f7f343f5f95640fd38a2c7dcde1ac1d2244c905c4ccd40f63b966b54fd15465
x86_64
cri-o-1.18.4-4.rhaos4.5.git6dee389.el8.x86_64.rpm SHA-256: 0d405e7af66e5a1eb815bed7ec9d2b45ef3b632568c9811e0995ad58c867dc69
cri-o-debuginfo-1.18.4-4.rhaos4.5.git6dee389.el8.x86_64.rpm SHA-256: 7f0ff66bc40da77519927a75d049635ed18cad6370846728dcbcca7fbda60f58
cri-o-debugsource-1.18.4-4.rhaos4.5.git6dee389.el8.x86_64.rpm SHA-256: 25a46e4547ede3c7d3e6aa507747b62440462c08a3da918eb41dbf36a823c146
openshift-clients-4.5.0-202011121956.p0.git.3609.b4952c1.el8.x86_64.rpm SHA-256: b09a18fbfa9ba30613a7ebb23830533b669405d6c4399b4ec300eacd2dd0a0d3
openshift-clients-redistributable-4.5.0-202011121956.p0.git.3609.b4952c1.el8.x86_64.rpm SHA-256: 1acca0112f4eb0835cc4a653e2977a6715c7468e192529bb6716c8dd795d79cd
openshift-hyperkube-4.5.0-202011131403.p0.git.0.d153f8f.el8.x86_64.rpm SHA-256: 24959f033653ab8483feeec892c28adbe9b093105d435e04532d7763ec3095d2

Red Hat OpenShift Container Platform 4.5 for RHEL 7

SRPM
atomic-enterprise-service-catalog-4.5.0-202011121956.p0.git.1808.0eb4933.el7.src.rpm SHA-256: e30a342b736128e4be60648b879eb523bc846df0be7a841d188d438b8ffbf5f0
atomic-openshift-service-idler-4.5.0-202011121956.p0.git.15.cccc412.el7.src.rpm SHA-256: d4423c576d524ce16d29f8da8b5a4b4093366ecbd84665183473bfa3013e92a1
cri-o-1.18.4-4.rhaos4.5.git6dee389.el7.src.rpm SHA-256: d59aea1d6a16b8d44f8b6a967cec6ecba1b32ca5d3da9d948fc467d28361941c
faq-0.0.6-5.el7.src.rpm SHA-256: af188ccc6f529be7296fd25b06829e656ba13db7df333f41f8c47511d97262a8
openshift-4.5.0-202011131403.p0.git.0.d153f8f.el7.src.rpm SHA-256: 5028091b297c02f8ab66d93cba0cee7ec3ab8f303fe6bd2ad61cfa962629ac72
openshift-ansible-4.5.0-202011121956.p0.git.0.7093c82.el7.src.rpm SHA-256: 40f44d5eae2c684c8ada01f9713b1dc29f51428af803d2fda9ad27a7c128da65
openshift-clients-4.5.0-202011121956.p0.git.3609.b4952c1.el7.src.rpm SHA-256: 5f82253957e977284b9a153afdaf8697de3e4f3d59989c68c58f5451da393af5
x86_64
atomic-enterprise-service-catalog-4.5.0-202011121956.p0.git.1808.0eb4933.el7.x86_64.rpm SHA-256: e87ac45a43d080359a6d162a2f3bb933f8f2a542b08f654df45b3a3204647d57
atomic-enterprise-service-catalog-svcat-4.5.0-202011121956.p0.git.1808.0eb4933.el7.x86_64.rpm SHA-256: 2ab3617eb89c5d977fb029169192048b1ecbe441cc2df5dcd0dc8fa1bd267695
atomic-openshift-service-idler-4.5.0-202011121956.p0.git.15.cccc412.el7.x86_64.rpm SHA-256: 19d2eb156f32e8eac708ace53a7b9b0f570b66badca83d83cc1bbf96fcdd92db
cri-o-1.18.4-4.rhaos4.5.git6dee389.el7.x86_64.rpm SHA-256: 0ce461120af955736163a6f035302a145c5ede55c73a35ed138d2e314c5c0ea5
cri-o-debuginfo-1.18.4-4.rhaos4.5.git6dee389.el7.x86_64.rpm SHA-256: 84fc984e1c2d05157c661889e5f2ce9432c49d9e9f0feef81d86f48a41207428
faq-0.0.6-5.el7.x86_64.rpm SHA-256: 2678d65e0bdfd65ae0a861e908fa0d1f728fa7cdd2f0f30ed9e1e20796f25b00
faq-debuginfo-0.0.6-5.el7.x86_64.rpm SHA-256: 6dcfdf08887896fa1a2536102e0e5a7986a4da0147b7b9ac2dd8e9a382786a5c
openshift-ansible-4.5.0-202011121956.p0.git.0.7093c82.el7.noarch.rpm SHA-256: 8cfd24287016419c5b6c847c1b52404a2e714e94df97d586485eb3e59a676ed8
openshift-ansible-test-4.5.0-202011121956.p0.git.0.7093c82.el7.noarch.rpm SHA-256: d6b25fd9e2c89f9e8d9d3594c5c6280bdc5bc3f2b33a6e86490053fcf63c52e0
openshift-clients-4.5.0-202011121956.p0.git.3609.b4952c1.el7.x86_64.rpm SHA-256: 35ca90b76ff5e36c9d26ea6b9afd8fc7ae6b3dd7d07efdfee6c7bbaac880d794
openshift-clients-redistributable-4.5.0-202011121956.p0.git.3609.b4952c1.el7.x86_64.rpm SHA-256: bff5df7c7c25ae9e537c57faeb0c93260ba1e049dcc5718b286ab8fdc5ecd08c
openshift-hyperkube-4.5.0-202011131403.p0.git.0.d153f8f.el7.x86_64.rpm SHA-256: 0008535193ce96b99b22ce6cb27d3cbcb970a75829c4e7aa233e6b04010fd352

Red Hat OpenShift Container Platform for Power 4.5 for RHEL 8

SRPM
cri-o-1.18.4-4.rhaos4.5.git6dee389.el8.src.rpm SHA-256: 2369ebde5452931b1a13c9efe790ce207e96670ad0f5d416dbf2b3df269bcde2
openshift-4.5.0-202011131403.p0.git.0.d153f8f.el8.src.rpm SHA-256: 6e7eb892cbc0db1387b2641db202a089a1acf725631b2172cd1c0952be8dc08e
openshift-clients-4.5.0-202011121956.p0.git.3609.b4952c1.el8.src.rpm SHA-256: 5f7f343f5f95640fd38a2c7dcde1ac1d2244c905c4ccd40f63b966b54fd15465
ppc64le
cri-o-1.18.4-4.rhaos4.5.git6dee389.el8.ppc64le.rpm SHA-256: 9517fd97b58dfef4c5f8f84a95b2566d4e588dede4c838e94debb703396d3e62
cri-o-debuginfo-1.18.4-4.rhaos4.5.git6dee389.el8.ppc64le.rpm SHA-256: 8c886377d5ff5e58a49cda3df8ee4287ee887dea51584176936e9a41e3e2cf34
cri-o-debugsource-1.18.4-4.rhaos4.5.git6dee389.el8.ppc64le.rpm SHA-256: 0aa48a6d9ff0e8595db87d60def5a430acfafc039a792cf8291c684235f8ca54
openshift-clients-4.5.0-202011121956.p0.git.3609.b4952c1.el8.ppc64le.rpm SHA-256: b7d28022d212c4e19bd97c408ab3368cec76a85d7c6441d3763d27744ba46085
openshift-hyperkube-4.5.0-202011131403.p0.git.0.d153f8f.el8.ppc64le.rpm SHA-256: ef103df68941725ae68aad7811d9631a611863016ca802aa5ab59c07d810cfe8

Red Hat OpenShift Container Platform for Power 4.5 for RHEL 7

SRPM
atomic-enterprise-service-catalog-4.5.0-202011121956.p0.git.1808.0eb4933.el7.src.rpm SHA-256: e30a342b736128e4be60648b879eb523bc846df0be7a841d188d438b8ffbf5f0
atomic-openshift-service-idler-4.5.0-202011121956.p0.git.15.cccc412.el7.src.rpm SHA-256: d4423c576d524ce16d29f8da8b5a4b4093366ecbd84665183473bfa3013e92a1
cri-o-1.18.4-4.rhaos4.5.git6dee389.el7.src.rpm SHA-256: d59aea1d6a16b8d44f8b6a967cec6ecba1b32ca5d3da9d948fc467d28361941c
faq-0.0.6-5.el7.src.rpm SHA-256: af188ccc6f529be7296fd25b06829e656ba13db7df333f41f8c47511d97262a8
openshift-4.5.0-202011131403.p0.git.0.d153f8f.el7.src.rpm SHA-256: 5028091b297c02f8ab66d93cba0cee7ec3ab8f303fe6bd2ad61cfa962629ac72
openshift-ansible-4.5.0-202011121956.p0.git.0.7093c82.el7.src.rpm SHA-256: 40f44d5eae2c684c8ada01f9713b1dc29f51428af803d2fda9ad27a7c128da65
openshift-clients-4.5.0-202011121956.p0.git.3609.b4952c1.el7.src.rpm SHA-256: 5f82253957e977284b9a153afdaf8697de3e4f3d59989c68c58f5451da393af5
ppc64le
atomic-enterprise-service-catalog-4.5.0-202011121956.p0.git.1808.0eb4933.el7.ppc64le.rpm SHA-256: ebd41f9ec8e0ff823b181b74f869b5c94431c5afecf54d9e6b984627b78ab54d
atomic-enterprise-service-catalog-svcat-4.5.0-202011121956.p0.git.1808.0eb4933.el7.ppc64le.rpm SHA-256: 16c86c48149dbd2a72e3bc39564b0ee73715abf039d6c9448026cd79a7a582e1
atomic-openshift-service-idler-4.5.0-202011121956.p0.git.15.cccc412.el7.ppc64le.rpm SHA-256: d874c7f6b8cb30ea9dffb91a86bdb3f6799f66d0ac379268c95363c4c1de3c88
cri-o-1.18.4-4.rhaos4.5.git6dee389.el7.ppc64le.rpm SHA-256: 9b1d00e1c317f6d856c65c9ca822c7f55e29b3c5addedae840fe0ca5896e68a5
cri-o-debuginfo-1.18.4-4.rhaos4.5.git6dee389.el7.ppc64le.rpm SHA-256: 3c08fdd6793f3d3f14043ae382af847474bdc8d9af275edc16cf9f4bd78a3b77
faq-0.0.6-5.el7.ppc64le.rpm SHA-256: 317fdf800c0f23eb254dc25d3cda7b29bd662cbea936129d455cbc249e86f700
faq-debuginfo-0.0.6-5.el7.ppc64le.rpm SHA-256: e765c3a124d0c42075927d20fa69345467e457cd5623427c8647b2487bf64c39
openshift-ansible-4.5.0-202011121956.p0.git.0.7093c82.el7.noarch.rpm SHA-256: 8cfd24287016419c5b6c847c1b52404a2e714e94df97d586485eb3e59a676ed8
openshift-ansible-test-4.5.0-202011121956.p0.git.0.7093c82.el7.noarch.rpm SHA-256: d6b25fd9e2c89f9e8d9d3594c5c6280bdc5bc3f2b33a6e86490053fcf63c52e0
openshift-clients-4.5.0-202011121956.p0.git.3609.b4952c1.el7.ppc64le.rpm SHA-256: 5e5a944543c4d9f98ad69856f7d53a99361c216f82164d2f8163254abf8e5423
openshift-hyperkube-4.5.0-202011131403.p0.git.0.d153f8f.el7.ppc64le.rpm SHA-256: 49284f4dd04d1401a06ae22684b9295b15f0f90695f1cdc34c4f89b5e61eb5a6

Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.5 for RHEL 8

SRPM
cri-o-1.18.4-4.rhaos4.5.git6dee389.el8.src.rpm SHA-256: 2369ebde5452931b1a13c9efe790ce207e96670ad0f5d416dbf2b3df269bcde2
openshift-4.5.0-202011131403.p0.git.0.d153f8f.el8.src.rpm SHA-256: 6e7eb892cbc0db1387b2641db202a089a1acf725631b2172cd1c0952be8dc08e
openshift-clients-4.5.0-202011121956.p0.git.3609.b4952c1.el8.src.rpm SHA-256: 5f7f343f5f95640fd38a2c7dcde1ac1d2244c905c4ccd40f63b966b54fd15465
s390x
cri-o-1.18.4-4.rhaos4.5.git6dee389.el8.s390x.rpm SHA-256: 13651c650dc69afd8ae2b13ac139bb3a4f942bca8085786503acc096c64ce480
cri-o-debuginfo-1.18.4-4.rhaos4.5.git6dee389.el8.s390x.rpm SHA-256: 4a3a00fc176b4235658718aa883466329a65b5766e6ba1514efe743922edef0b
cri-o-debugsource-1.18.4-4.rhaos4.5.git6dee389.el8.s390x.rpm SHA-256: b529954d454b9c2be082caf7c5ea5322d38ea642ff3b2c8e946cc917fffa26f5
openshift-clients-4.5.0-202011121956.p0.git.3609.b4952c1.el8.s390x.rpm SHA-256: c257c071b2bbfefdda4e917d204d19e047fbf6e68ef9084f3959d51fe1e5bda1
openshift-hyperkube-4.5.0-202011131403.p0.git.0.d153f8f.el8.s390x.rpm SHA-256: aab0d43e9813462fab29f53c10aea63dc60344621f79fba70290977ce4fc4b02

Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.5 for RHEL 7

SRPM
atomic-enterprise-service-catalog-4.5.0-202011121956.p0.git.1808.0eb4933.el7.src.rpm SHA-256: e30a342b736128e4be60648b879eb523bc846df0be7a841d188d438b8ffbf5f0
atomic-openshift-service-idler-4.5.0-202011121956.p0.git.15.cccc412.el7.src.rpm SHA-256: d4423c576d524ce16d29f8da8b5a4b4093366ecbd84665183473bfa3013e92a1
cri-o-1.18.4-4.rhaos4.5.git6dee389.el7.src.rpm SHA-256: d59aea1d6a16b8d44f8b6a967cec6ecba1b32ca5d3da9d948fc467d28361941c
faq-0.0.6-5.el7.src.rpm SHA-256: af188ccc6f529be7296fd25b06829e656ba13db7df333f41f8c47511d97262a8
openshift-4.5.0-202011131403.p0.git.0.d153f8f.el7.src.rpm SHA-256: 5028091b297c02f8ab66d93cba0cee7ec3ab8f303fe6bd2ad61cfa962629ac72
openshift-ansible-4.5.0-202011121956.p0.git.0.7093c82.el7.src.rpm SHA-256: 40f44d5eae2c684c8ada01f9713b1dc29f51428af803d2fda9ad27a7c128da65
openshift-clients-4.5.0-202011121956.p0.git.3609.b4952c1.el7.src.rpm SHA-256: 5f82253957e977284b9a153afdaf8697de3e4f3d59989c68c58f5451da393af5
s390x
atomic-enterprise-service-catalog-4.5.0-202011121956.p0.git.1808.0eb4933.el7.s390x.rpm SHA-256: c3e7c3ed1fde8fe4190ccf3222ec81da62989375c0da7de18edbbb107bfc4f0f
atomic-enterprise-service-catalog-svcat-4.5.0-202011121956.p0.git.1808.0eb4933.el7.s390x.rpm SHA-256: 0bef65bd1fdf8a448776da39120d64fdacd07615c80638a5abb00c848cd30ab0
atomic-openshift-service-idler-4.5.0-202011121956.p0.git.15.cccc412.el7.s390x.rpm SHA-256: 451f5e263d3299deec2aa2b6dd3d72fd935c3191840936286cb5c213d1934544
cri-o-1.18.4-4.rhaos4.5.git6dee389.el7.s390x.rpm SHA-256: 837df32636abaca5a7303cfaa7ccfd4f894e60aa40435d7d79a89ece96fbf3c1
cri-o-debuginfo-1.18.4-4.rhaos4.5.git6dee389.el7.s390x.rpm SHA-256: 9dbba78c5094fe296a0944fe8c2ba7f97671efbad8b36b2051505970036f188d
faq-0.0.6-5.el7.s390x.rpm SHA-256: f79dd4dd58f8f59f81ce7abf365eecf4119cbc092da4fc5d1d8aed1031016f56
faq-debuginfo-0.0.6-5.el7.s390x.rpm SHA-256: c6b6a1f0fb7ce7193510fd1788d7da5a5e670a2e2a5beebc2b8324f5443b8f24
openshift-ansible-4.5.0-202011121956.p0.git.0.7093c82.el7.noarch.rpm SHA-256: 8cfd24287016419c5b6c847c1b52404a2e714e94df97d586485eb3e59a676ed8
openshift-ansible-test-4.5.0-202011121956.p0.git.0.7093c82.el7.noarch.rpm SHA-256: d6b25fd9e2c89f9e8d9d3594c5c6280bdc5bc3f2b33a6e86490053fcf63c52e0
openshift-clients-4.5.0-202011121956.p0.git.3609.b4952c1.el7.s390x.rpm SHA-256: fdade84ae5dd0c65830b3026f1021a9ccc4b966df60ab521c46b17cf30762316
openshift-hyperkube-4.5.0-202011131403.p0.git.0.d153f8f.el7.s390x.rpm SHA-256: 0edda7b668d3d6eb55c79a8677999c89f6b7e8bee1851a7ad214111cbe85d53d

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.