Incorrect calculation in Red Hat OpenShift Container Platform 4.7

1) Incorrect calculation

EUVDB-ID: #VU50047

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-3114

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incorrect calculation performed by the application in "crypto/elliptic/p224.go". A remote attacker can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before

openshift-ansible (Red Hat package): before 4.7.0-202103181433.p0.git.0.729df27.el7

python-oslo-log (Red Hat package): before 4.4.0-0.20210310191258.9b29c90.el8

python-ironic-lib (Red Hat package): before 4.4.1-0.20210129211219.7ac01e1.el8

openstack-ironic-python-agent (Red Hat package): before 6.4.4-0.20210310142329.99b9953.el8

openshift-kuryr (Red Hat package): before 4.7.0-202103171728.p0.git.2502.8383c08.el8

openshift-clients (Red Hat package): before 4.7.0-202103191426.p0.git.3953.f3a7513.el7

openshift (Red Hat package): before 4.7.0-202103181538.p0.git.97109.7576cdc.el7

ironic-images (Red Hat package): before 15.2-20210315.1.el8

cri-o (Red Hat package): before 1.20.2-3.rhaos4.7.gitfecc319.el7

NetworkManager (Red Hat package): before 1.26.0-14.1.rhaos4.7.el8

CPE2.3

• cpe:2.3:a:red_hat:red_hat_openshift_container_platform:*:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:openshift-ansible_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-oslo-log_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-ironic-lib_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:openstack-ironic-python-agent_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:openshift-kuryr_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:openshift-clients_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:openshift_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:ironic-images_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:cri-o_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:networkmanager_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2021:0958

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.