-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   
Red Hat Security Advisory

Synopsis:          Important: OpenShift Container Platform 3.11.394 bug fix and security update
Advisory ID:       RHSA-2021:0637-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:0637
Issue date:        2021-03-03
CVE Names:         CVE-2020-1945 CVE-2020-2304 CVE-2020-2305
                   CVE-2020-2306 CVE-2020-2307 CVE-2020-2308
                   CVE-2020-2309 CVE-2020-11979 CVE-2020-25658
====================================================================
1. Summary:

Red Hat OpenShift Container Platform release 3.11.394 is now available with
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.11 - noarch, ppc64le, x86_64

3. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

* jenkins-2-plugins/subversion: XML parser is not preventing XML external
entity (XXE) attacks (CVE-2020-2304)

* jenkins-2-plugins/mercurial: XML parser is not preventing XML external
entity (XXE) attacks (CVE-2020-2305)

* ant: Insecure temporary file vulnerability (CVE-2020-1945)

* jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint
could result in information disclosure (CVE-2020-2306)

* jenkins-2-plugins/kubernetes: Jenkins controller environment variables
are accessible in Kubernetes plug-in (CVE-2020-2307)

* jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes
Plugin allows listing pod templates (CVE-2020-2308)

* jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes
plug-in allows enumerating credentials IDs (CVE-2020-2309)

* ant: Insecure temporary file (CVE-2020-11979)

* python-rsa: Bleichenbacher timing oracle attack against RSA decryption
(CVE-2020-25658)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.394. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2021:0638

Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_r
elease_notes.html

This update fixes the following bugs among others:

* Previously, the restart-cluster playbook did not evaluate the defined
cluster size for ops clusters. This was causing come clusters to never
complete their restart. This bug fix passes the logging ops cluster size,
allowing restarts of ops clusters to complete successfully. (BZ#1879407)

* Previously, the `openshift_named_certificates` role checked the contents
of the `ca-bundle.crt` file during cluster installation. This caused the
check to fail during initial installation because the `ca-bundle.crt` file
is not yet created in that scenario. This bug fix allows the cluster to
skip checking the `ca-bundle.crt` file if it does not exist, resulting in
initial installations succeeding. (BZ#1920567)

* Previously, if the `openshift_release` attribute was not set in the
Ansible inventory file, the nodes of the cluster would fail during an
upgrade. This was caused by the `cluster_facts.yml` file being gathered
before the `openshift_release` attribute was defined by the upgrade
playbook. Now the `cluster_facts.yml` file is gathered after the
`openshift_version` role runs and the `openshift_release` attribute is set,
allowing for successful node upgrades. (BZ#1921353)

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages and images.

4. Solution:

Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.394, for important instructions on how to upgrade your cluster and
fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_r
elease_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

5. Bugs fixed (https://bugzilla.redhat.com/):

1837444 - CVE-2020-1945 ant: insecure temporary file vulnerability
1849003 - fact dicts returned are of type string rather than dict
1873346 - In-place upgrade of OCP 3.11 does not upgrade Kuryr components
1879407 - The restart-cluster playbook doesn't take into account that openshift_logging_es_ops_cluster_size  could be different from openshift_logging_es_cluster_size
1889972 - CVE-2020-25658 python-rsa: bleichenbacher timing oracle attack against RSA decryption
1895939 - CVE-2020-2304 jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks
1895940 - CVE-2020-2305 jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks
1895941 - CVE-2020-2306 jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information disclosure
1895945 - CVE-2020-2307 jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes Plugin
1895946 - CVE-2020-2308 jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates
1895947 - CVE-2020-2309 jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows enumerating credentials IDs
1903699 - Prometheus consumes all available memory
1903702 - CVE-2020-11979 ant: insecure temporary file
1918392 - Unable to access kibana URLafter enabling HTTP2 on Haproxy router
1920567 - [release-3.11] - ca-bundle.crt(/etc/origin/master/ca-bundle.crt) is missing on the fresh installation process
1921353 - OCP 3.11.374 Upgrade fails with Either OpenShift needs to be installed or openshift_release needs to be specified
1924614 - Provide jenkins agent image for maven36
1924811 - Provide jenkins agent image for maven36
1929170 - kuryr-cni pods in crashloop after updating OCP due to RuntimeError caused by attempting to delete eth0 host interface
1929216 - KeyError: 'addresses' in kuryr-controller when Endpoints' slice only lists notReadyAddresses

6. Package List:

Red Hat OpenShift Container Platform 3.11:

Source:
atomic-enterprise-service-catalog-3.11.394-1.git.1675.fdb6e0b.el7.src.rpm
atomic-openshift-3.11.394-1.git.0.e03a88e.el7.src.rpm
atomic-openshift-cluster-autoscaler-3.11.394-1.git.0.1900c76.el7.src.rpm
atomic-openshift-descheduler-3.11.394-1.git.299.ad3a3c0.el7.src.rpm
atomic-openshift-dockerregistry-3.11.394-1.git.481.6e48246.el7.src.rpm
atomic-openshift-metrics-server-3.11.394-1.git.53.3d82586.el7.src.rpm
atomic-openshift-node-problem-detector-3.11.394-1.git.263.49acf3a.el7.src.rpm
atomic-openshift-service-idler-3.11.394-1.git.15.73f73cd.el7.src.rpm
atomic-openshift-web-console-3.11.394-1.git.667.08dd2a6.el7.src.rpm
golang-github-openshift-oauth-proxy-3.11.394-1.git.439.4c37707.el7.src.rpm
golang-github-prometheus-alertmanager-3.11.394-1.git.0.1fbb64c.el7.src.rpm
golang-github-prometheus-node_exporter-3.11.394-1.git.1062.8adc4b8.el7.src.rpm
golang-github-prometheus-prometheus-3.11.394-1.git.5026.2c9627f.el7.src.rpm
haproxy-1.8.28-1.el7.src.rpm
jenkins-2-plugins-3.11.1612862361-1.el7.src.rpm
jenkins-2.263.3.1612433584-1.el7.src.rpm
openshift-ansible-3.11.394-6.git.0.47ec25d.el7.src.rpm
openshift-enterprise-autoheal-3.11.394-1.git.218.59eb597.el7.src.rpm
openshift-enterprise-cluster-capacity-3.11.394-1.git.379.92adfdc.el7.src.rpm
openshift-kuryr-3.11.394-1.git.1490.16ed375.el7.src.rpm
python-rsa-4.5-3.el7.src.rpm

noarch:
atomic-openshift-docker-excluder-3.11.394-1.git.0.e03a88e.el7.noarch.rpm
atomic-openshift-excluder-3.11.394-1.git.0.e03a88e.el7.noarch.rpm
jenkins-2-plugins-3.11.1612862361-1.el7.noarch.rpm
jenkins-2.263.3.1612433584-1.el7.noarch.rpm
openshift-ansible-3.11.394-6.git.0.47ec25d.el7.noarch.rpm
openshift-ansible-docs-3.11.394-6.git.0.47ec25d.el7.noarch.rpm
openshift-ansible-playbooks-3.11.394-6.git.0.47ec25d.el7.noarch.rpm
openshift-ansible-roles-3.11.394-6.git.0.47ec25d.el7.noarch.rpm
openshift-ansible-test-3.11.394-6.git.0.47ec25d.el7.noarch.rpm
openshift-kuryr-cni-3.11.394-1.git.1490.16ed375.el7.noarch.rpm
openshift-kuryr-common-3.11.394-1.git.1490.16ed375.el7.noarch.rpm
openshift-kuryr-controller-3.11.394-1.git.1490.16ed375.el7.noarch.rpm
python2-kuryr-kubernetes-3.11.394-1.git.1490.16ed375.el7.noarch.rpm
python2-rsa-4.5-3.el7.noarch.rpm

ppc64le:
atomic-enterprise-service-catalog-3.11.394-1.git.1675.fdb6e0b.el7.ppc64le.rpm
atomic-enterprise-service-catalog-svcat-3.11.394-1.git.1675.fdb6e0b.el7.ppc64le.rpm
atomic-openshift-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-clients-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-cluster-autoscaler-3.11.394-1.git.0.1900c76.el7.ppc64le.rpm
atomic-openshift-descheduler-3.11.394-1.git.299.ad3a3c0.el7.ppc64le.rpm
atomic-openshift-hyperkube-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-hypershift-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-master-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-metrics-server-3.11.394-1.git.53.3d82586.el7.ppc64le.rpm
atomic-openshift-node-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-node-problem-detector-3.11.394-1.git.263.49acf3a.el7.ppc64le.rpm
atomic-openshift-pod-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-sdn-ovs-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-service-idler-3.11.394-1.git.15.73f73cd.el7.ppc64le.rpm
atomic-openshift-template-service-broker-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-tests-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-web-console-3.11.394-1.git.667.08dd2a6.el7.ppc64le.rpm
golang-github-openshift-oauth-proxy-3.11.394-1.git.439.4c37707.el7.ppc64le.rpm
haproxy-debuginfo-1.8.28-1.el7.ppc64le.rpm
haproxy18-1.8.28-1.el7.ppc64le.rpm
openshift-enterprise-autoheal-3.11.394-1.git.218.59eb597.el7.ppc64le.rpm
openshift-enterprise-cluster-capacity-3.11.394-1.git.379.92adfdc.el7.ppc64le.rpm
prometheus-3.11.394-1.git.5026.2c9627f.el7.ppc64le.rpm
prometheus-alertmanager-3.11.394-1.git.0.1fbb64c.el7.ppc64le.rpm
prometheus-node-exporter-3.11.394-1.git.1062.8adc4b8.el7.ppc64le.rpm

x86_64:
atomic-enterprise-service-catalog-3.11.394-1.git.1675.fdb6e0b.el7.x86_64.rpm
atomic-enterprise-service-catalog-svcat-3.11.394-1.git.1675.fdb6e0b.el7.x86_64.rpm
atomic-openshift-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-clients-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-clients-redistributable-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-cluster-autoscaler-3.11.394-1.git.0.1900c76.el7.x86_64.rpm
atomic-openshift-descheduler-3.11.394-1.git.299.ad3a3c0.el7.x86_64.rpm
atomic-openshift-dockerregistry-3.11.394-1.git.481.6e48246.el7.x86_64.rpm
atomic-openshift-hyperkube-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-hypershift-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-master-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-metrics-server-3.11.394-1.git.53.3d82586.el7.x86_64.rpm
atomic-openshift-node-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-node-problem-detector-3.11.394-1.git.263.49acf3a.el7.x86_64.rpm
atomic-openshift-pod-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-sdn-ovs-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-service-idler-3.11.394-1.git.15.73f73cd.el7.x86_64.rpm
atomic-openshift-template-service-broker-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-tests-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-web-console-3.11.394-1.git.667.08dd2a6.el7.x86_64.rpm
golang-github-openshift-oauth-proxy-3.11.394-1.git.439.4c37707.el7.x86_64.rpm
haproxy-debuginfo-1.8.28-1.el7.x86_64.rpm
haproxy18-1.8.28-1.el7.x86_64.rpm
openshift-enterprise-autoheal-3.11.394-1.git.218.59eb597.el7.x86_64.rpm
openshift-enterprise-cluster-capacity-3.11.394-1.git.379.92adfdc.el7.x86_64.rpm
prometheus-3.11.394-1.git.5026.2c9627f.el7.x86_64.rpm
prometheus-alertmanager-3.11.394-1.git.0.1fbb64c.el7.x86_64.rpm
prometheus-node-exporter-3.11.394-1.git.1062.8adc4b8.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-1945
https://access.redhat.com/security/cve/CVE-2020-2304
https://access.redhat.com/security/cve/CVE-2020-2305
https://access.redhat.com/security/cve/CVE-2020-2306
https://access.redhat.com/security/cve/CVE-2020-2307
https://access.redhat.com/security/cve/CVE-2020-2308
https://access.redhat.com/security/cve/CVE-2020-2309
https://access.redhat.com/security/cve/CVE-2020-11979
https://access.redhat.com/security/cve/CVE-2020-25658
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYD+BmNzjgjWX9erEAQjE+Q//ZZiX1bD9qOdi3w9TpwdZLagxnE5NTy5Z
Ru/GN0qaTIBHo8QHZqgt6jBT5ADfW0KgEdA3N+fi43f4ud5fO+2eQcdE4oeSAE93
T5PAL+UBlb4ykAqQQnLVMO8G5Hc2IOw68wZjC+YFcEB36FnZifCk/z14OdUR3WyT
g5ohmXKJw3ojfOsPK0ZIePS4V7RwTosagKHdyVa+tpxxVlkcZf2q08e5U7YkkhKv
d/4UzYfGYtpm8ozYde1Cvs6cCU2ar7VQjsGW597BgSMXYESDqnPTKUJ5y8btFTwL
j5z0ZSc96MBOkyebqxqhNdeFwg4liCl0RhBSUBhsG6e40Du8+3+LPUS579R1cp8N
qCW0ODujVh804XNOXSqGAbmPXb6BL8uIY6j4kdzfZH4xgBGG1oOhiUcjPrJQkohD
7fRf/aLCtRno9d98oylMuxPWEf4XfeltF4zin8hWdvBlfSxfy6aGjdmXcHWIP3Es
4jL7h5IBtTn/8IXO5kXUlBeHOTNfjA48W/MmxyN6TNoTFrrsgR1pk7RUCxjAgOi/
Nk/IYlBheWb1Bvm/QCMpA5qDUSNZnmADw6BBRoViE+/DKBM9/DEUX6KOq6H3Ak0v
wA7QOAVVk2COxBJCsmy7EJUJYMuyfrNkovukWKHUQQuDFcjy5nWYbGmmejX/STB2
+rElYOcZkO0=9NLN
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce