SB2020120203 - Multiple vulnerabilities in Red Hat OpenShift Container Platform

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020120203

SB2020120203 - Multiple vulnerabilities in Red Hat OpenShift Container Platform

Published: December 2, 2020 Updated: July 1, 2021

Security Bulletin ID SB2020120203
Severity
Critical
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-8559)

The vulnerability allows a remote privileged user to execute arbitrary code.

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.


2) Heap-based buffer overflow (CVE-ID: CVE-2020-15999)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in freetype library when processing TTF files. A remote attacker can pass specially crafted TTF file with PNG sbit glyphs to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, this vulnerability is being actively exploited in the wild.


Remediation

Install update from vendor's website.

References