Multiple vulnerabilities in OpenShift Container Platform 4.9

Published: 2022-02-24

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2021-29923 CVE-2021-36221
CWE-ID	CWE-20 CWE-362
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	openshift-clients (Red Hat package) Operating systems & Components / Operating system package or component openshift (Red Hat package) Operating systems & Components / Operating system package or component jenkins-2-plugins (Red Hat package) Operating systems & Components / Operating system package or component openshift-ansible (Red Hat package) Operating systems & Components / Operating system package or component cri-o (Red Hat package) Operating systems & Components / Operating system package or component ignition (Red Hat package) Operating systems & Components / Operating system package or component cri-tools (Red Hat package) Operating systems & Components / Operating system package or component butane (Red Hat package) Operating systems & Components / Operating system package or component golang-github-prometheus-promu (Red Hat package) Operating systems & Components / Operating system package or component ovn21.12 (Red Hat package) Operating systems & Components / Operating system package or component Red Hat OpenShift Container Platform Client/Desktop applications / Software for system administration
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU56829

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-29923

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input in net.ParseIP and net.ParseCIDR, as the Go interpreter does not properly consider extraneous zero characters at the beginning of an IP address octet. A remote attacker can bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

openshift-clients (Red Hat package): 4.3.1-202001310552.git.1.075d46a.el7 - 4.9.0-202109101042.p0.git.96e95ce.assembly.stream.el8

Red Hat OpenShift Container Platform: 4.9.0 - 4.9.21

openshift (Red Hat package): 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8 - 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8

jenkins-2-plugins (Red Hat package): 4.9.1630555871-1.el8 - 4.9.1643389956-1.el8

openshift-ansible (Red Hat package): 3.2.42-1.git.0.6b09be9.el7 - 4.8.0-202109241839.p0.git.4bb45f8.assembly.stream.el7

cri-o (Red Hat package): 1.22.1-4.rhaos4.9.gite3dfe61.el7 - 1.22.1-4.rhaos4.9.gite3dfe61.el8

ignition (Red Hat package): 2.12.0-1.rhaos4.9.el8

cri-tools (Red Hat package): 1.22.0-1.el8

butane (Red Hat package): 0.13.1-1.rhaos4.9.el8

golang-github-prometheus-promu (Red Hat package): 0.5.0-3.git642a960.el8 - 0.5.0-4.git642a960.el8

ovn21.12 (Red Hat package): before 21.12.0-25.el8fdp

External links

http://access.redhat.com/errata/RHSA-2022:0557
http://access.redhat.com/errata/RHSA-2022:0561

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Race condition

EUVDB-ID: #VU55668