Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title OpenShift Container Platform 3.11 security update
Informations
Name RHSA-2020:0451 First vendor Publication 2020-02-19
Vendor RedHat Last vendor Modification 2020-02-19
Severity (Vendor) N/A Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Red Hat OpenShift Container Platform release 3.11.170 is now available with updates to packages and images that fix several bugs.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

Security Fix(es):

* SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

3. Solution:

Before applying this update, ensure all previously released errata relevant to your system is applied.

See the following documentation, which will be updated shortly for release 3.11.170, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_r elease_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.

4. Bugs fixed (https://bugzilla.redhat.com/):

1369383 - CVE-2016-2183 SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

5. References:

https://access.redhat.com/security/cve/CVE-2016-2183 https://access.redhat.com/security/cve/CVE-2019-13734 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/articles/2548661

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2020-0451.html

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-787 Out-of-bounds Write (CWE/SANS Top 25)
50 % CWE-200 Information Exposure

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2
Application 4724
Application 151
Application 26
Application 1
Application 1
Application 2
Application 227
Application 1
Application 2
Application 1
Application 2
Os 4
Os 2
Os 2
Os 4
Os 4
Os 2
Os 4
Os 2
Os 3
Os 3
Os 2

Snort® IPS/IDS

Date Description
2016-10-18 SSH weak blowfish cipher suite use attempt
RuleID : 40190 - Revision : 2 - Type : POLICY-OTHER
2016-10-18 SSH weak 3DES cipher suite use attempt
RuleID : 40189 - Revision : 2 - Type : POLICY-OTHER
2016-10-18 SSL weak 3DES cipher suite use attempt
RuleID : 40188 - Revision : 2 - Type : POLICY-OTHER
2016-10-18 SSL weak 3DES cipher suite use attempt
RuleID : 40187 - Revision : 2 - Type : POLICY-OTHER
2016-10-18 SSL weak 3DES cipher suite use attempt
RuleID : 40186 - Revision : 2 - Type : POLICY-OTHER

Nessus® Vulnerability Scanner

Date Description
2018-07-16 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2018-2123.nasl - Type : ACT_GATHER_INFO
2018-02-28 Name : The version of Arista Networks EOS running on the remote device is affected b...
File : arista_eos_sa0024.nasl - Type : ACT_GATHER_INFO
2018-02-28 Name : The version of Arista Networks EOS running on the remote device is affected b...
File : arista_eos_sa0024_4_17.nasl - Type : ACT_GATHER_INFO
2017-11-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-3240.nasl - Type : ACT_GATHER_INFO
2017-11-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-3113.nasl - Type : ACT_GATHER_INFO
2017-09-20 Name : The remote VMware ESXi 6.0 host is affected by multiple vulnerabilities.
File : vmware_esxi_6_0_build_5485776_remote.nasl - Type : ACT_GATHER_INFO
2017-09-15 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-2709.nasl - Type : ACT_GATHER_INFO
2017-09-15 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-2710.nasl - Type : ACT_GATHER_INFO
2017-09-13 Name : The version of Java SDK installed on the remote AIX host is affected by multi...
File : aix_java_jan2017_advisory.nasl - Type : ACT_GATHER_INFO
2017-07-20 Name : A web application installed on the remote host is affected by multiple vulner...
File : oracle_e-business_cpu_jul_2017.nasl - Type : ACT_GATHER_INFO
2017-07-20 Name : The remote database server is affected by multiple vulnerabilities.
File : oracle_rdbms_cpu_jul_2017.nasl - Type : ACT_GATHER_INFO
2017-07-13 Name : The remote Virtuozzo host is missing a security update.
File : Virtuozzo_VZLSA-2017-0180.nasl - Type : ACT_GATHER_INFO
2017-07-13 Name : The remote Virtuozzo host is missing a security update.
File : Virtuozzo_VZLSA-2017-0269.nasl - Type : ACT_GATHER_INFO
2017-07-06 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201707-01.nasl - Type : ACT_GATHER_INFO
2017-06-26 Name : The Tenable SecurityCenter application on the remote host contains an OpenSSL...
File : securitycenter_openssl_1_0_1u.nasl - Type : ACT_GATHER_INFO
2017-05-31 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2017-1444-1.nasl - Type : ACT_GATHER_INFO
2017-05-24 Name : A database server installed on the remote host is affected by multiple vulner...
File : ibm_informix_server_swg22002897.nasl - Type : ACT_GATHER_INFO
2017-05-10 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-1216.nasl - Type : ACT_GATHER_INFO
2017-05-02 Name : An application installed on the remote host is affected by multiple vulnerabi...
File : oracle_secure_global_desktop_apr_2017_cpu.nasl - Type : ACT_GATHER_INFO
2017-05-01 Name : The remote EulerOS host is missing a security update.
File : EulerOS_SA-2016-1090.nasl - Type : ACT_GATHER_INFO
2017-05-01 Name : The remote EulerOS host is missing multiple security updates.
File : EulerOS_SA-2017-1015.nasl - Type : ACT_GATHER_INFO
2017-05-01 Name : The remote EulerOS host is missing multiple security updates.
File : EulerOS_SA-2017-1016.nasl - Type : ACT_GATHER_INFO
2017-05-01 Name : The remote EulerOS host is missing multiple security updates.
File : EulerOS_SA-2017-1027.nasl - Type : ACT_GATHER_INFO
2017-05-01 Name : The remote EulerOS host is missing multiple security updates.
File : EulerOS_SA-2017-1028.nasl - Type : ACT_GATHER_INFO
2017-04-28 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-3270-1.nasl - Type : ACT_GATHER_INFO
2017-04-21 Name : An enterprise management application installed on the remote host is affected...
File : oracle_enterprise_manager_apr_2017_cpu.nasl - Type : ACT_GATHER_INFO
2017-03-30 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2017-0839-1.nasl - Type : ACT_GATHER_INFO
2017-03-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2017-0716-1.nasl - Type : ACT_GATHER_INFO
2017-03-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2017-0719-1.nasl - Type : ACT_GATHER_INFO
2017-03-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2017-0720-1.nasl - Type : ACT_GATHER_INFO
2017-03-09 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-0462.nasl - Type : ACT_GATHER_INFO
2017-03-02 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL13167034.nasl - Type : ACT_GATHER_INFO
2017-03-01 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-0336.nasl - Type : ACT_GATHER_INFO
2017-03-01 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-0337.nasl - Type : ACT_GATHER_INFO
2017-03-01 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-0338.nasl - Type : ACT_GATHER_INFO
2017-02-21 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2017-278.nasl - Type : ACT_GATHER_INFO
2017-02-21 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2017-0490-1.nasl - Type : ACT_GATHER_INFO
2017-02-16 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-3198-1.nasl - Type : ACT_GATHER_INFO
2017-02-15 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2017-797.nasl - Type : ACT_GATHER_INFO
2017-02-15 Name : An application running on the remote host is affected by multiple vulnerabili...
File : nessus_tns_2016_16.nasl - Type : ACT_GATHER_INFO
2017-02-15 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2017-0460-1.nasl - Type : ACT_GATHER_INFO
2017-02-14 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2017-0269.nasl - Type : ACT_GATHER_INFO
2017-02-14 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2017-0269.nasl - Type : ACT_GATHER_INFO
2017-02-13 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-0269.nasl - Type : ACT_GATHER_INFO
2017-02-13 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20170213_java_1_7_0_openjdk_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2017-02-09 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-3194-1.nasl - Type : ACT_GATHER_INFO
2017-02-06 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2017-201.nasl - Type : ACT_GATHER_INFO
2017-02-01 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2017-0346-1.nasl - Type : ACT_GATHER_INFO
2017-01-27 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2017-791.nasl - Type : ACT_GATHER_INFO
2017-01-26 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201701-65.nasl - Type : ACT_GATHER_INFO
2017-01-26 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-3179-1.nasl - Type : ACT_GATHER_INFO
2017-01-25 Name : A web application running on the remote host is affected by multiple vulnerab...
File : mysql_enterprise_monitor_3_1_5_7958.nasl - Type : ACT_GATHER_INFO
2017-01-25 Name : A web application running on the remote host is affected by multiple vulnerab...
File : mysql_enterprise_monitor_3_2_5_1141.nasl - Type : ACT_GATHER_INFO
2017-01-25 Name : A web application running on the remote host is affected by multiple vulnerab...
File : mysql_enterprise_monitor_3_3_1_1112.nasl - Type : ACT_GATHER_INFO
2017-01-25 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20170120_java_1_8_0_openjdk_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2017-01-23 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2017-0180.nasl - Type : ACT_GATHER_INFO
2017-01-23 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2017-0180.nasl - Type : ACT_GATHER_INFO
2017-01-23 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-0180.nasl - Type : ACT_GATHER_INFO
2017-01-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-0175.nasl - Type : ACT_GATHER_INFO
2017-01-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-0176.nasl - Type : ACT_GATHER_INFO
2017-01-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-0177.nasl - Type : ACT_GATHER_INFO
2017-01-19 Name : The remote Windows host contains a programming platform that is affected by m...
File : oracle_java_cpu_jan_2017.nasl - Type : ACT_GATHER_INFO
2017-01-19 Name : The remote Unix host contains a programming platform that is affected by mult...
File : oracle_java_cpu_jan_2017_unix.nasl - Type : ACT_GATHER_INFO
2017-01-06 Name : A vulnerability scanner installed on the remote host is affected by multiple ...
File : pvs_5_2_0.nasl - Type : ACT_GATHER_INFO
2017-01-05 Name : The remote device is missing a vendor-supplied security patch.
File : juniper_jsa10759.nasl - Type : ACT_GATHER_INFO
2016-12-29 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2016-363-01.nasl - Type : ACT_GATHER_INFO
2016-12-27 Name : An application running on the remote web server is affected by multiple vulne...
File : ibm_bigfix_remote_control_9_1_3.nasl - Type : ACT_GATHER_INFO
2016-12-07 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201612-16.nasl - Type : ACT_GATHER_INFO
2016-11-22 Name : The remote AIX host has a version of OpenSSL installed that is affected by mu...
File : aix_openssl_advisory21.nasl - Type : ACT_GATHER_INFO
2016-11-01 Name : The remote service supports the use of 64-bit block ciphers.
File : ssl_64bitblock_supported_ciphers.nasl - Type : ACT_GATHER_INFO
2016-10-21 Name : The remote database server is affected by multiple vulnerabilities.
File : mysql_5_6_34_rpm.nasl - Type : ACT_GATHER_INFO
2016-10-21 Name : The remote database server is affected by multiple vulnerabilities.
File : mysql_5_7_16_rpm.nasl - Type : ACT_GATHER_INFO
2016-10-20 Name : The remote database server is affected by multiple vulnerabilities.
File : mysql_5_6_34.nasl - Type : ACT_GATHER_INFO
2016-10-20 Name : The remote database server is affected by multiple vulnerabilities.
File : mysql_5_7_16.nasl - Type : ACT_GATHER_INFO
2016-10-17 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-1189.nasl - Type : ACT_GATHER_INFO
2016-10-17 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2016-3627.nasl - Type : ACT_GATHER_INFO
2016-10-17 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2016-0141.nasl - Type : ACT_GATHER_INFO
2016-10-13 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2016-755.nasl - Type : ACT_GATHER_INFO
2016-10-12 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-1172.nasl - Type : ACT_GATHER_INFO
2016-10-07 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-2468-1.nasl - Type : ACT_GATHER_INFO
2016-10-06 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-2458-1.nasl - Type : ACT_GATHER_INFO
2016-09-30 Name : The remote service is affected by multiple vulnerabilities.
File : openssl_1_0_1u.nasl - Type : ACT_GATHER_INFO
2016-09-30 Name : The remote service is affected by multiple vulnerabilities.
File : openssl_1_0_2i.nasl - Type : ACT_GATHER_INFO
2016-09-29 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20160927_openssl_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2016-09-28 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2016-1940.nasl - Type : ACT_GATHER_INFO
2016-09-28 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-1130.nasl - Type : ACT_GATHER_INFO
2016-09-28 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-1134.nasl - Type : ACT_GATHER_INFO
2016-09-28 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2016-1940.nasl - Type : ACT_GATHER_INFO
2016-09-28 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2016-0135.nasl - Type : ACT_GATHER_INFO
2016-09-28 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2016-1940.nasl - Type : ACT_GATHER_INFO
2016-09-28 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-2394-1.nasl - Type : ACT_GATHER_INFO
2016-09-27 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-2387-1.nasl - Type : ACT_GATHER_INFO
2016-09-26 Name : The remote Debian host is missing a security update.
File : debian_DLA-637.nasl - Type : ACT_GATHER_INFO
2016-09-26 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-3087-2.nasl - Type : ACT_GATHER_INFO
2016-09-23 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2016-266-01.nasl - Type : ACT_GATHER_INFO
2016-09-23 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3673.nasl - Type : ACT_GATHER_INFO
2016-09-23 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_43eaa65680bc11e6bf52b499baebfeaf.nasl - Type : ACT_GATHER_INFO
2016-09-23 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-3087-1.nasl - Type : ACT_GATHER_INFO
2016-08-25 Name : The service running on the remote host uses a weak encryption block cipher by...
File : openssl_1_1_0.nasl - Type : ACT_GATHER_INFO
2016-07-25 Name : The remote web server is affected by multiple vulnerabilities.
File : oracle_http_server_cpu_jul_2016.nasl - Type : ACT_GATHER_INFO
2015-10-23 Name : The remote web server is affected by multiple vulnerabilities.
File : oracle_http_server_cpu_oct_2015.nasl - Type : ACT_GATHER_INFO
2015-01-27 Name : The remote web server is affected by multiple vulnerabilities.
File : oracle_http_server_cpu_jan_2015.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2020-03-19 13:19:59
  • First insertion