SB2021033058 - Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.7
Published: March 30, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Incorrect calculation (CVE-ID: CVE-2021-3114)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to incorrect calculation performed by the application in "crypto/elliptic/p224.go". A remote attacker can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
2) Memory leak (CVE-ID: CVE-2020-27827)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in lldpd when processing packets with multiple instances of certain TLVs. A remote attacker can send specially crafted traffic to the system and perform a denial of service (DoS) attack.
3) Input validation error (CVE-ID: CVE-2020-35498)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when processing network packets. A remote attacker can send specially crafted traffic to the system and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.