Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.4 packages



| Updated: 2025-04-24
Risk Low
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2020-2160
CVE-2020-2161
CVE-2020-2162
CVE-2020-2163
CWE-ID CWE-352
CWE-79
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Red Hat OpenShift Container Platform
Client/Desktop applications / Software for system administration

openshift-ansible (Red Hat package)
Operating systems & Components / Operating system package or component

jenkins (Red Hat package)
Operating systems & Components / Operating system package or component

atomic-openshift-service-idler (Red Hat package)
Operating systems & Components / Operating system package or component

atomic-enterprise-service-catalog (Red Hat package)
Operating systems & Components / Operating system package or component

openshift-kuryr (Red Hat package)
Operating systems & Components / Operating system package or component

openshift-clients (Red Hat package)
Operating systems & Components / Operating system package or component

openshift (Red Hat package)
Operating systems & Components / Operating system package or component

machine-config-daemon (Red Hat package)
Operating systems & Components / Operating system package or component

cri-o (Red Hat package)
Operating systems & Components / Operating system package or component

conmon (Red Hat package)
Operating systems & Components / Operating system package or component

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Cross-site request forgery

EUVDB-ID: #VU26390

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2160

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin for any URL. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before

openshift-ansible (Red Hat package): before 4.4.0-202006061254.git.1.a996454.el7

jenkins (Red Hat package): before 2.222.1.1591351066-1.el7

atomic-openshift-service-idler (Red Hat package): before 4.4.0-202006080017.git.1.7e463c3.el7

atomic-enterprise-service-catalog (Red Hat package): before 4.4.0-202006080017.git.1.77a5cc9.el7

openshift-kuryr (Red Hat package): before 4.4.0-202006080017.git.1.855ef1d.el8

openshift-clients (Red Hat package): before 4.4.0-202006061254.git.1.26cb6dc.el7

openshift (Red Hat package): before 4.4.0-202006061254.git.1.dc84fb4.el7

machine-config-daemon (Red Hat package): before 4.4.0-202006080017.git.1.32e0736.el8

cri-o (Red Hat package): before 1.17.4-14.dev.rhaos4.4.gitb93af5d.el7

conmon (Red Hat package): before 2.0.17-1.rhaos4.4.el7

CPE2.3 External links

https://access.redhat.com/errata/RHBA-2020:2444


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stored cross-site scripting

EUVDB-ID: #VU26391

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2161

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in labels for nodes. A remote authenticated attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before

openshift-ansible (Red Hat package): before 4.4.0-202006061254.git.1.a996454.el7

jenkins (Red Hat package): before 2.222.1.1591351066-1.el7

atomic-openshift-service-idler (Red Hat package): before 4.4.0-202006080017.git.1.7e463c3.el7

atomic-enterprise-service-catalog (Red Hat package): before 4.4.0-202006080017.git.1.77a5cc9.el7

openshift-kuryr (Red Hat package): before 4.4.0-202006080017.git.1.855ef1d.el8

openshift-clients (Red Hat package): before 4.4.0-202006061254.git.1.26cb6dc.el7

openshift (Red Hat package): before 4.4.0-202006061254.git.1.dc84fb4.el7

machine-config-daemon (Red Hat package): before 4.4.0-202006080017.git.1.32e0736.el8

cri-o (Red Hat package): before 1.17.4-14.dev.rhaos4.4.gitb93af5d.el7

conmon (Red Hat package): before 2.0.17-1.rhaos4.4.el7

CPE2.3 External links

https://access.redhat.com/errata/RHBA-2020:2444


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Stored cross-site scripting

EUVDB-ID: #VU26392

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2162

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in file parameters. A remote authenticated attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before

openshift-ansible (Red Hat package): before 4.4.0-202006061254.git.1.a996454.el7

jenkins (Red Hat package): before 2.222.1.1591351066-1.el7

atomic-openshift-service-idler (Red Hat package): before 4.4.0-202006080017.git.1.7e463c3.el7

atomic-enterprise-service-catalog (Red Hat package): before 4.4.0-202006080017.git.1.77a5cc9.el7

openshift-kuryr (Red Hat package): before 4.4.0-202006080017.git.1.855ef1d.el8

openshift-clients (Red Hat package): before 4.4.0-202006061254.git.1.26cb6dc.el7

openshift (Red Hat package): before 4.4.0-202006061254.git.1.dc84fb4.el7

machine-config-daemon (Red Hat package): before 4.4.0-202006080017.git.1.32e0736.el8

cri-o (Red Hat package): before 1.17.4-14.dev.rhaos4.4.gitb93af5d.el7

conmon (Red Hat package): before 2.0.17-1.rhaos4.4.el7

CPE2.3 External links

https://access.redhat.com/errata/RHBA-2020:2444


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Stored cross-site scripting

EUVDB-ID: #VU26393

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2163

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in list view column headers. A remote authenticated attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before

openshift-ansible (Red Hat package): before 4.4.0-202006061254.git.1.a996454.el7

jenkins (Red Hat package): before 2.222.1.1591351066-1.el7

atomic-openshift-service-idler (Red Hat package): before 4.4.0-202006080017.git.1.7e463c3.el7

atomic-enterprise-service-catalog (Red Hat package): before 4.4.0-202006080017.git.1.77a5cc9.el7

openshift-kuryr (Red Hat package): before 4.4.0-202006080017.git.1.855ef1d.el8

openshift-clients (Red Hat package): before 4.4.0-202006061254.git.1.26cb6dc.el7

openshift (Red Hat package): before 4.4.0-202006061254.git.1.dc84fb4.el7

machine-config-daemon (Red Hat package): before 4.4.0-202006080017.git.1.32e0736.el8

cri-o (Red Hat package): before 1.17.4-14.dev.rhaos4.4.gitb93af5d.el7

conmon (Red Hat package): before 2.0.17-1.rhaos4.4.el7

CPE2.3 External links

https://access.redhat.com/errata/RHBA-2020:2444


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###