RHSA-2021:2021 - Security Advisory

Topic

Openshift Serverless 1.10.2 is now available.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Serverless 1.10.2 is a generally available release of the OpenShift Serverless Operator. This version of the OpenShift Serverless Operator is supported on Red Hat OpenShift Container Platform version 4.5.

Security Fix(es):

• golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)
• golang: cmd/go: packages using cgo can cause arbitrary code execution at build time (CVE-2021-3115)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

See the documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.5/html/serverless_applications/index

Affected Products

• Red Hat Openshift Serverless 1 x86_64

Fixes

• BZ - 1918750 - CVE-2021-3114 golang: crypto/elliptic: incorrect operations on the P-224 curve
• BZ - 1918761 - CVE-2021-3115 golang: cmd/go: packages using cgo can cause arbitrary code execution at build time

CVEs

• CVE-2018-20843
• CVE-2018-1000858
• CVE-2019-5018
• CVE-2019-13050
• CVE-2019-13627
• CVE-2019-14889
• CVE-2019-15903
• CVE-2019-16168
• CVE-2019-16935
• CVE-2019-19221
• CVE-2019-19906
• CVE-2019-19956
• CVE-2019-20218
• CVE-2019-20387
• CVE-2019-20388
• CVE-2019-20454
• CVE-2019-20907
• CVE-2019-20916
• CVE-2020-1730
• CVE-2020-6405
• CVE-2020-7595
• CVE-2020-8492
• CVE-2020-9327
• CVE-2020-13630
• CVE-2020-13631
• CVE-2020-13632
• CVE-2020-14422
• CVE-2021-3114
• CVE-2021-3115
• CVE-2021-3449
• CVE-2021-3450
• CVE-2021-20305

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/openshift_container_platform/4.5/html/serverless_applications/index