Improper Authentication in Kubernetes - CVE-2021-3636

Vulnerability identifier: #VU56243

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3636

CWE-ID: CWE-287

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The Service CA is automatically mounted into all pods, allowing them to safely connect to trusted in-cluster services that present certificates signed by the trusted Service CA. The incorrect inclusion of additional CAs in this certificate would allow an attacker that compromises any of the additional CAs to masquerade as a trusted in-cluster service.

Kubernetes
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
toolbox (Red Hat package)
coreos-installer (Red Hat package)
python-openshift (Red Hat package)
butane (Red Hat package)
python-pyrsistent (Red Hat package)
console-login-helper-messages (Red Hat package)
python-eventlet (Red Hat package)
python-hardware (Red Hat package)
python-openstacksdk (Red Hat package)
runc (Red Hat package)
python-oslo-upgradecheck (Red Hat package)
rteval-loads (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
kata-containers (Red Hat package)
python-debtcollector (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
haproxy (Red Hat package)
python-oslo-service (Red Hat package)
python-tooz (Red Hat package)
ignition (Red Hat package)
openvswitch2.15 (Red Hat package)
jenkins (Red Hat package)
podman (Red Hat package)
python-oslo-context (Red Hat package)
python-jsonschema (Red Hat package)
python-stevedore (Red Hat package)
python-oslo-policy (Red Hat package)
python-sushy (Red Hat package)
python-oslo-serialization (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-oslo-concurrency (Red Hat package)
python-oslo-log (Red Hat package)
python-ironic-lib (Red Hat package)
python-oslo-utils (Red Hat package)
openshift-kuryr (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
jenkins-2-plugins (Red Hat package)
rust-afterburn (Red Hat package)
python-oslo-i18n (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
python-oslo-db (Red Hat package)
python-oslo-config (Red Hat package)
openstack-ironic-inspector (Red Hat package)
python-kubernetes (Red Hat package)
openstack-ironic (Red Hat package)
ovn2.13 (Red Hat package)
redhat-release-coreos (Red Hat package)
ostree (Red Hat package)
ironic-images (Red Hat package)

Install updates from vendor's website.

Kubernetes - update to 1.21.2
Red Hat OpenShift Container Platform - addressed in versions 4.8.2, 4.10.30
toolbox (Red Hat package) - update to 0.0.8-3.rhaos4.8.el8
coreos-installer (Red Hat package) - update to 0.9.0-6.rhaos4.8.el8
python-openshift (Red Hat package) - update to 0.12.1-1.el8
butane (Red Hat package) - update to 0.12.1-1.rhaos4.8.el8
python-pyrsistent (Red Hat package) - update to 0.16.0-3.el8ost
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.8.el8
python-eventlet (Red Hat package) - update to 0.25.2-4.el8
python-hardware (Red Hat package) - update to 0.27.0-0.20210406121246.756fedb.el8
python-openstacksdk (Red Hat package) - update to 0.53.0-0.20210325011601.4629245.el8
runc (Red Hat package) - addressed in versions 1.0.0-98.rhaos4.8.gitcd80260.el7, 1.0.0-98.rhaos4.8.gitcd80260.el8
python-oslo-upgradecheck (Red Hat package) - update to 1.3.0-0.20210325003851.9f95a6e.el8
rteval-loads (Red Hat package) - update to 1.4-12.el8
Migration Toolkit for Containers - update to 1.5.1
cri-tools (Red Hat package) - addressed in versions 1.21.0-2.el7, 1.21.0-2.el8
cri-o (Red Hat package) - addressed in versions 1.21.2-5.rhaos4.8.gitb27d974.el7, 1.21.2-5.rhaos4.8.gitb27d974.el8
python-sushy-oem-idrac (Red Hat package) - update to 2.0.1-0.20210326152858.83b7eb0.el8
kata-containers (Red Hat package) - update to 2.1.0-4.el8
python-debtcollector (Red Hat package) - update to 2.2.0-0.20210324220630.649189d.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 2.2.1-0.20210325143713.70e39c8.el8
haproxy (Red Hat package) - addressed in versions 2.2.13-1.el7, 2.2.13-1.el8
python-oslo-service (Red Hat package) - update to 2.5.0-0.20210325014731.d25e454.el8
python-tooz (Red Hat package) - update to 2.8.0-0.20210324235001.54448e9.el8
ignition (Red Hat package) - update to 2.9.0-6.rhaos4.8.el8
openvswitch2.15 (Red Hat package) - update to 2.15.0-9.el8fdp
jenkins (Red Hat package) - update to 2.289.1.1624020353-1.el8
podman (Red Hat package) - update to 3.0.1-6.el8
python-oslo-context (Red Hat package) - update to 3.2.0-0.20210325043103.0d02866.el8
python-jsonschema (Red Hat package) - update to 3.2.0-5.el8ost
python-stevedore (Red Hat package) - update to 3.3.0-0.20210325001012.7d7154f.el8
python-oslo-policy (Red Hat package) - update to 3.7.0-0.20210325051823.d853485.el8
python-sushy (Red Hat package) - update to 3.7.1-0.20210428165244.bc49878.el8
python-oslo-serialization (Red Hat package) - update to 4.1.0-0.20210325012242.8445e61.el8
python-keystoneauth1 (Red Hat package) - update to 4.3.0-0.20210325001456.6a66271.el8
python-oslo-concurrency (Red Hat package) - update to 4.4.0-0.20210325004915.7dcf9e9.el8
python-oslo-log (Red Hat package) - update to 4.4.0-0.20210409081224.9b29c90.el8
python-ironic-lib (Red Hat package) - update to 4.6.2-0.20210608101214.ca2e4ba.el8
python-oslo-utils (Red Hat package) - update to 4.8.0-0.20210325043201.3288539.el8
openshift-kuryr (Red Hat package) - update to 4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8
openshift-ansible (Red Hat package) - update to 4.8.0-202106281541.p0.git.626f7a3.assembly.stream.el7
openshift-clients (Red Hat package) - addressed in versions 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7, 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el8
openshift (Red Hat package) - addressed in versions 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7, 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.8.1624022417-1.el8
rust-afterburn (Red Hat package) - update to 5.0.0-1.rhaos4.8.el8
python-oslo-i18n (Red Hat package) - update to 5.0.1-0.20210324221600.73187bd.el8
openstack-ironic-python-agent (Red Hat package) - update to 7.0.2-0.20210611153100.bfa97cb.el8
python-oslo-db (Red Hat package) - update to 8.5.0-0.20210325041241.503db60.el8
python-oslo-config (Red Hat package) - update to 8.5.0-0.20210325050501.cfa2564.el8
openstack-ironic-inspector (Red Hat package) - update to 10.6.1-0.20210406091336.579f59c.el8
python-kubernetes (Red Hat package) - update to 12.0.1-1.el8
openstack-ironic (Red Hat package) - update to 17.0.4-0.20210713221218.a415e7e.el8
ovn2.13 (Red Hat package) - update to 20.12.0-25.el8fdp
redhat-release-coreos (Red Hat package) - update to 48.84-4.el8
ostree (Red Hat package) - update to 2020.7-5.el8_4
ironic-images (Red Hat package) - update to 2021.1-20210614.1.el8

• https://bugzilla.redhat.com/show_bug.cgi?id=1978621

• Authentication bypass in Kubernetes
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8 packages