Issued:: 2021-03-03
Updated:: 2021-03-03

RHSA-2021:0637 - Important: OpenShift Container Platform 3.11.394 bug fix and security update

Synopsis

Important: OpenShift Container Platform 3.11.394 bug fix and security update

Type/Severity

Security Advisory Important

Topic

Red Hat OpenShift Container Platform release 3.11.394 is now available with updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

Security Fix(es):

jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks (CVE-2020-2304)
jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks (CVE-2020-2305)
ant: Insecure temporary file vulnerability (CVE-2020-1945)
jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information disclosure (CVE-2020-2306)
jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes plug-in (CVE-2020-2307)
jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates (CVE-2020-2308)
jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes plug-in allows enumerating credentials IDs (CVE-2020-2309)
ant: Insecure temporary file (CVE-2020-11979)
python-rsa: Bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.394. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2021:0638

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

This page is not included, but the link has been rewritten to point to the nearest parent document.https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update fixes the following bugs among others:

Previously, the restart-cluster playbook did not evaluate the defined cluster size for ops clusters. This was causing come clusters to never complete their restart. This bug fix passes the logging ops cluster size, allowing restarts of ops clusters to complete successfully. (BZ#1879407)
Previously, the openshift_named_certificates role checked the contents of the ca-bundle.crt file during cluster installation. This caused the check to fail during initial installation because the ca-bundle.crt file is not yet created in that scenario. This bug fix allows the cluster to skip checking the ca-bundle.crt file if it does not exist, resulting in initial installations succeeding. (BZ#1920567)
Previously, if the openshift_release attribute was not set in the Ansible inventory file, the nodes of the cluster would fail during an upgrade. This was caused by the cluster_facts.yml file being gathered before the openshift_release attribute was defined by the upgrade playbook. Now the cluster_facts.yml file is gathered after the openshift_version role runs and the openshift_release attribute is set, allowing for successful node upgrades. (BZ#1921353)

All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

Solution

Before applying this update, ensure all previously released errata relevant to your system is applied.

See the following documentation, which will be updated shortly for release 3.11.394, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

This page is not included, but the link has been rewritten to point to the nearest parent document.https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.https://access.redhat.com/articles/11258.

Affected Products

Product	Version	Arch
Red Hat OpenShift Container Platform	3.11	x86_64
Red Hat OpenShift Container Platform for Power	3.11	ppc64le

Updated Packages

golang-github-openshift-oauth-proxy-3.11.394-1.git.439.4c37707.el7.src.rpm
openshift-enterprise-cluster-capacity-3.11.394-1.git.379.92adfdc.el7.src.rpm
haproxy18-1.8.28-1.el7.ppc64le.rpm
atomic-openshift-node-problem-detector-3.11.394-1.git.263.49acf3a.el7.x86_64.rpm
atomic-openshift-pod-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-service-idler-3.11.394-1.git.15.73f73cd.el7.ppc64le.rpm
openshift-ansible-roles-3.11.394-6.git.0.47ec25d.el7.noarch.rpm
golang-github-openshift-oauth-proxy-3.11.394-1.git.439.4c37707.el7.ppc64le.rpm
atomic-openshift-web-console-3.11.394-1.git.667.08dd2a6.el7.ppc64le.rpm
atomic-openshift-excluder-3.11.394-1.git.0.e03a88e.el7.noarch.rpm
atomic-openshift-hypershift-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-metrics-server-3.11.394-1.git.53.3d82586.el7.src.rpm
atomic-openshift-template-service-broker-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
python2-rsa-4.5-3.el7.noarch.rpm
python-rsa-4.5-3.el7.src.rpm
openshift-enterprise-cluster-capacity-3.11.394-1.git.379.92adfdc.el7.ppc64le.rpm
atomic-openshift-node-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
openshift-ansible-3.11.394-6.git.0.47ec25d.el7.noarch.rpm
atomic-openshift-cluster-autoscaler-3.11.394-1.git.0.1900c76.el7.src.rpm
prometheus-alertmanager-3.11.394-1.git.0.1fbb64c.el7.x86_64.rpm
openshift-enterprise-cluster-capacity-3.11.394-1.git.379.92adfdc.el7.x86_64.rpm
atomic-enterprise-service-catalog-svcat-3.11.394-1.git.1675.fdb6e0b.el7.x86_64.rpm
openshift-kuryr-common-3.11.394-1.git.1490.16ed375.el7.noarch.rpm
openshift-kuryr-controller-3.11.394-1.git.1490.16ed375.el7.noarch.rpm
atomic-openshift-descheduler-3.11.394-1.git.299.ad3a3c0.el7.ppc64le.rpm
prometheus-alertmanager-3.11.394-1.git.0.1fbb64c.el7.ppc64le.rpm
atomic-openshift-hyperkube-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
openshift-ansible-playbooks-3.11.394-6.git.0.47ec25d.el7.noarch.rpm
openshift-kuryr-3.11.394-1.git.1490.16ed375.el7.src.rpm
atomic-openshift-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-dockerregistry-3.11.394-1.git.481.6e48246.el7.x86_64.rpm
atomic-enterprise-service-catalog-3.11.394-1.git.1675.fdb6e0b.el7.ppc64le.rpm
atomic-openshift-node-problem-detector-3.11.394-1.git.263.49acf3a.el7.ppc64le.rpm
atomic-openshift-clients-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
haproxy-debuginfo-1.8.28-1.el7.x86_64.rpm
atomic-openshift-dockerregistry-3.11.394-1.git.481.6e48246.el7.src.rpm
atomic-openshift-cluster-autoscaler-3.11.394-1.git.0.1900c76.el7.ppc64le.rpm
atomic-openshift-master-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-node-problem-detector-3.11.394-1.git.263.49acf3a.el7.src.rpm
atomic-openshift-template-service-broker-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
jenkins-2.263.3.1612433584-1.el7.src.rpm
openshift-kuryr-cni-3.11.394-1.git.1490.16ed375.el7.noarch.rpm
prometheus-3.11.394-1.git.5026.2c9627f.el7.x86_64.rpm
atomic-openshift-metrics-server-3.11.394-1.git.53.3d82586.el7.x86_64.rpm
atomic-openshift-3.11.394-1.git.0.e03a88e.el7.src.rpm
golang-github-openshift-oauth-proxy-3.11.394-1.git.439.4c37707.el7.x86_64.rpm
openshift-ansible-docs-3.11.394-6.git.0.47ec25d.el7.noarch.rpm
atomic-enterprise-service-catalog-3.11.394-1.git.1675.fdb6e0b.el7.src.rpm
atomic-openshift-tests-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-enterprise-service-catalog-3.11.394-1.git.1675.fdb6e0b.el7.x86_64.rpm
atomic-openshift-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
haproxy-debuginfo-1.8.28-1.el7.ppc64le.rpm
jenkins-2.263.3.1612433584-1.el7.noarch.rpm
atomic-openshift-sdn-ovs-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
golang-github-prometheus-prometheus-3.11.394-1.git.5026.2c9627f.el7.src.rpm
haproxy18-1.8.28-1.el7.x86_64.rpm
atomic-openshift-cluster-autoscaler-3.11.394-1.git.0.1900c76.el7.x86_64.rpm
golang-github-prometheus-node_exporter-3.11.394-1.git.1062.8adc4b8.el7.src.rpm
atomic-openshift-hyperkube-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
atomic-openshift-sdn-ovs-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-tests-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
atomic-openshift-metrics-server-3.11.394-1.git.53.3d82586.el7.ppc64le.rpm
atomic-openshift-pod-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
jenkins-2-plugins-3.11.1612862361-1.el7.src.rpm
atomic-openshift-service-idler-3.11.394-1.git.15.73f73cd.el7.src.rpm
atomic-openshift-node-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
prometheus-node-exporter-3.11.394-1.git.1062.8adc4b8.el7.ppc64le.rpm
prometheus-node-exporter-3.11.394-1.git.1062.8adc4b8.el7.x86_64.rpm
atomic-openshift-web-console-3.11.394-1.git.667.08dd2a6.el7.src.rpm
openshift-enterprise-autoheal-3.11.394-1.git.218.59eb597.el7.src.rpm
atomic-openshift-clients-redistributable-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
prometheus-3.11.394-1.git.5026.2c9627f.el7.ppc64le.rpm
atomic-enterprise-service-catalog-svcat-3.11.394-1.git.1675.fdb6e0b.el7.ppc64le.rpm
atomic-openshift-hypershift-3.11.394-1.git.0.e03a88e.el7.ppc64le.rpm
golang-github-prometheus-alertmanager-3.11.394-1.git.0.1fbb64c.el7.src.rpm
haproxy-1.8.28-1.el7.src.rpm
atomic-openshift-descheduler-3.11.394-1.git.299.ad3a3c0.el7.src.rpm
python2-kuryr-kubernetes-3.11.394-1.git.1490.16ed375.el7.noarch.rpm
atomic-openshift-web-console-3.11.394-1.git.667.08dd2a6.el7.x86_64.rpm
atomic-openshift-clients-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
openshift-enterprise-autoheal-3.11.394-1.git.218.59eb597.el7.ppc64le.rpm
jenkins-2-plugins-3.11.1612862361-1.el7.noarch.rpm
atomic-openshift-service-idler-3.11.394-1.git.15.73f73cd.el7.x86_64.rpm
openshift-enterprise-autoheal-3.11.394-1.git.218.59eb597.el7.x86_64.rpm
atomic-openshift-docker-excluder-3.11.394-1.git.0.e03a88e.el7.noarch.rpm
atomic-openshift-descheduler-3.11.394-1.git.299.ad3a3c0.el7.x86_64.rpm
atomic-openshift-master-3.11.394-1.git.0.e03a88e.el7.x86_64.rpm
openshift-ansible-test-3.11.394-6.git.0.47ec25d.el7.noarch.rpm
openshift-ansible-3.11.394-6.git.0.47ec25d.el7.src.rpm

Fixes

CVEs

References

https://access.redhat.com/security/updates/classification/#important

Additional information

The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.