Red Hat OpenShift Container Platform 3.11 vulnerabilities
11 known vulnerabilities in Red Hat OpenShift Container Platform 3.11 from Red Hat. 11 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.4 High severity
Red Hat OpenShift Container Platform 4.15: Improper Authorization
A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As
- 8.1 High severity
Red Hat OpenShift Container Platform 4.12: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
- 8.3 High severity
OADP-1.3-RHEL-9: Improper Validation of Integrity Check Value
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
- 7.2 High severity
Red Hat OpenShift Container Platform 4.12: Improper Neutralization of Special Elements used in a Command
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.
- 7.7 High severity
Red Hat OpenShift Container Platform 4.12: Exposure of Sensitive Information to an Unauthorized Actor
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
- 8.6 High severity
Red Hat Enterprise Linux 8: Improper Link Resolution Before File Access
A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a moun
- 7.5 High severity
openvswitch: Uncaught Exception
A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.
- 7.5 High severity
Red Hat Enterprise Linux 9: Improper Verification of Cryptographic Signature
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote clie
- 7.5 High severity
Red Hat OpenShift Container Platform 4.13: Allocation of Resources Without Limits or Throttling
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of servic
- 7.5 High severity
kubernetes: Incorrect Authorization
A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.
- 7.5 High severity
openshift: Weak Password Requirements
A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.