SB2021062509 - Multiple vulnerabilities in OpenShift Container Platform
Published: June 25, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) Improper Authorization (CVE-ID: CVE-2021-3499)
The vulnerability allows a remote attacker to gain access to restricted resources.
The vulnerability exists in OVN Kubernetes where the Egress Firewall does not reliably apply firewall rules when there is multiple DNS rules. A remote attacker can gain unauthorized access to the protected system.
2) Input validation error (CVE-ID: CVE-2020-28362)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in a number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD). A remote attacker can pass large input data to the application, specifically as divisor or modulo argument larger than 3168 bits (on 32-bit architectures) or 6336 bits (on 64-bit architectures).
3) Incorrect calculation (CVE-ID: CVE-2021-3114)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to incorrect calculation performed by the application in "crypto/elliptic/p224.go". A remote attacker can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
4) Input validation error (CVE-ID: CVE-2021-21639)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected software does not validate the type of object created after loading the data submitted to the "config.xml" REST API endpoint of a node. A remote authenticated attacker can replace a node with one of a different type.
5) Improper Authentication (CVE-ID: CVE-2021-21640)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to the affected software does not properly check that a newly created view has an allowed name. A remote authenticated attacker can create views with invalid or already-used names.
6) Information disclosure (CVE-ID: CVE-2021-28163)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. If the ${jetty.base} directory or the ${jetty.base}/webapps directory is a symlink, the contents of the ${jetty.base}/webapps directory may be deployed as a static web application, exposing the content of the directory for download.
7) Resource exhaustion (CVE-ID: CVE-2021-28165)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing large TLS frames. A remote attacker can send specially crafted data to the server, trigger CPU high load and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.