Integer overflow in Red Hat OpenShift Container Platform 3.11

1) Integer overflow

EUVDB-ID: #VU50957

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-27813

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow when processing frames received via a websocket connection. A remote attacker can pass specially crafted data to the application, trigger integer overflow and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before 3.11.404

openshift-kuryr (Red Hat package): before 3.11.404-1.git.1494.91fb403.el7

openshift-enterprise-cluster-capacity (Red Hat package): before 3.11.404-1.git.379.e6e2a1d.el7

openshift-enterprise-autoheal (Red Hat package): before 3.11.404-1.git.218.c348621.el7

openshift-ansible (Red Hat package): before 3.11.404-1.git.0.d161108.el7

golang-github-prometheus-prometheus (Red Hat package): before 3.11.404-1.git.5026.5f1d705.el7

golang-github-prometheus-node_exporter (Red Hat package): before 3.11.404-1.git.1062.611825d.el7

golang-github-prometheus-alertmanager (Red Hat package): before 3.11.404-1.git.0.2817295.el7

golang-github-openshift-oauth-proxy (Red Hat package): before 3.11.404-1.git.439.06870e9.el7

atomic-openshift-web-console (Red Hat package): before 3.11.404-1.git.677.0e37db7.el7

atomic-openshift-service-idler (Red Hat package): before 3.11.404-1.git.15.6c64591.el7

atomic-openshift-node-problem-detector (Red Hat package): before 3.11.400-1.git.263.930aa57.el7

atomic-openshift-metrics-server (Red Hat package): before 3.11.404-1.git.53.b9081b6.el7

atomic-openshift-dockerregistry (Red Hat package): before 3.11.404-1.git.481.5000e2c.el7

atomic-openshift-descheduler (Red Hat package): before 3.11.404-1.git.299.2bfbb2f.el7

atomic-openshift-cluster-autoscaler (Red Hat package): before 3.11.404-1.git.0.2c258fe.el7

atomic-openshift (Red Hat package): before 3.11.404-1.git.0.dd58619.el7

atomic-enterprise-service-catalog (Red Hat package): before 3.11.404-1.git.1675.3094ee9.el7

CPE2.3

• cpe:2.3:a:red_hat:red_hat_openshift_container_platform:*:*:*:*:*:*:*:*
• cpe:2.3:o:red_hat:openshift-kuryr_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:openshift-enterprise-cluster-capacity_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:openshift-enterprise-autoheal_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:openshift-ansible_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:golang-github-prometheus-prometheus_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:golang-github-prometheus-node_exporter_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:golang-github-prometheus-alertmanager_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:golang-github-openshift-oauth-proxy_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:atomic-openshift-web-console_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:atomic-openshift-service-idler_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:atomic-openshift-node-problem-detector_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:atomic-openshift-metrics-server_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:atomic-openshift-dockerregistry_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:atomic-openshift-descheduler_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:atomic-openshift-cluster-autoscaler_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:atomic-openshift_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:atomic-enterprise-service-catalog_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2021:0833

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.