The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5634 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.7.0. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2020:5633

    All OpenShift Container Platform 4.7 users are advised to upgrade to these     updated packages and images when they are available in the appropriate     release channel. To check for available updates, use the OpenShift Console     or the CLI oc command. Instructions for upgrading a cluster are available     at     https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-between-     minor.html#understanding-upgrade-channels_updating-cluster-between-minor.

    Security Fix(es):

    * gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

    * kubernetes: Ceph RBD adminSecrets exposed in logs when loglevel >= 4 (CVE-2020-8566)

    * containerd: credentials leak during image pull (CVE-2020-15157)

    * python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

    * atomic-openshift: cross-namespace owner references can trigger deletions of valid children     (CVE-2019-3884)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

リモートのRedhat Enterprise Linux 7 / 8ホストにインストールされているパッケージは、RHSA-2020: 5634のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - atomic-openshift：名前空間をまたぐ所有者の参照が、有効な子の削除をトリガーすることが可能です（CVE-2019-3884）

  - containerd：資格情報が画像プル時のリーク（CVE-2020-15157）

  - python-rsa: RSA復号に対してBleichenbacherのタイミングオラクル攻撃（CVE-2020-25658）

  - golang：math / big：非常に大きな数の再帰的除算中のパニック（CVE-2020-28362）

  - kubernetes：ログに露出CEPH RBD adminSecretsときログレベル> = 4（CVE-2020-8566）

  -gogo / protobuf：plugin / unmarshal / unmarshal.goに特定のインデックス検証がありません (CVE-2021-3121)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

遠端 Redhat Enterprise Linux 7/8 主機上安裝的套件受到 RHSA-2020: 5634 公告中提及的多個弱點影響。

  - atomic-openshift：跨命名空間擁有者參照可觸發有效子項的刪除 (CVE-2019-3884)

  - containerd：影像提取期間會發生憑證洩漏問題 (CVE-2020-15157)

  - python-rsa：針對 RSA 解密的 bleichenbacher timing oracle 攻擊 (CVE-2020-25658)

  - golang：math/big：在非常大的數字進行遞迴分割時發生錯誤 (CVE-2020-28362)

  - kubernetes：當 loglevel> = 4 時，記錄中會暴露 Ceph RBD adminSecrets (CVE-2020-8566)

  - gogo/protobuf：plugin/unmarshal/unmarshal.go 缺少特定的索引驗證 (CVE-2021-3121)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Redhat Enterprise Linux 7 / 8 主机上安装的程序包受到 RHSA-2020: 5634 公告中提及的多个漏洞影响。

  - atomic-openshift：跨命名空间所有者引用可触发程序删除有效子项 (CVE-2019-3884)

  - containerd：在图像拉取期间发生凭据泄露 (CVE-2020-15157)

  - python-rsa：针对 RSA 解密发起 bleichenbacher Timing oracle 攻击 (CVE-2020-25658)

  - golang：math/big：在极大数递归拆分期间发生的错误 (CVE-2020-28362)

  - kubernetes：日志级别 > = 4 时，日志中会暴露 Ceph RBD admin 密钥 (CVE-2020-8566)

  - gogo/protobuf：plugin/unmarshal/unmarshal.go 缺少某些索引验证 (CVE-2021-3121)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	Name	Product	Family	Published	Updated	Severity
146810	RHEL 7 / 8 : OpenShift Container Platform 4.7.0 (RHSA-2020:5634)	Nessus	Red Hat Local Security Checks	2/24/2021	11/7/2024	high
146810	RHEL 7/8：OpenShift Container Platform 4.7.0パッケージ（RHSA-2020：5634)	Nessus	Red Hat Local Security Checks	2/24/2021	11/7/2024	high
146810	RHEL 7/8：OpenShift 容器平台 4.7.0 套件 (RHSA-2020: 5634)	Nessus	Red Hat Local Security Checks	2/24/2021	11/7/2024	high
146810	RHEL 7 / 8：OpenShift Container Platform 4.7.0 程序包 (RHSA-2020: 5634)	Nessus	Red Hat Local Security Checks	2/24/2021	11/7/2024	high

Detections

Analytics

Plugins Search

high

high

high

high