Red Hat Product Errata RHSA-2019:2661 - Security Advisory
Issued:
2019-09-11
Updated:
2019-09-11

RHSA-2019:2661 - Security Advisory

Synopsis

Important: Red Hat OpenShift Container Platform 4.1 openshift RPM security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the openshift and atomic-enterprise-service-catalog packages is now available for Red Hat OpenShift Container Platform 4.1.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Both the openshift and atomic-enterprise-service-catalog packages have been rebuilt with updates versions of golang. The golang packages provide the Go programming language compiler.

Security Fix(es):

  • HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)
  • HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Solution

For OpenShift Container Platform 4.1 see the following documentation, which
will be updated shortly for release 4.1.14, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.1/updating/updating-cluster-cli.html.

Affected Products

  • Red Hat OpenShift Container Platform 4.1 for RHEL 8 x86_64
  • Red Hat OpenShift Container Platform 4.1 for RHEL 7 x86_64

Fixes

  • BZ - 1735645 - CVE-2019-9512 HTTP/2: flood using PING frames results in unbounded memory growth
  • BZ - 1735744 - CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth

Red Hat OpenShift Container Platform 4.1 for RHEL 8

SRPM
openshift-4.1.14-201908290858.git.0.3bd3467.el8.src.rpm SHA-256: 13d015892d4b7d08e089cadd7f4d9dab00e838ad3193370fef097eecce65dc11
x86_64
openshift-clients-4.1.14-201908290858.git.0.3bd3467.el8.x86_64.rpm SHA-256: 189153d3217cc2882ebf58db9f0186a1298671fc07ba5cebfac25b593965d208
openshift-clients-redistributable-4.1.14-201908290858.git.0.3bd3467.el8.x86_64.rpm SHA-256: f1d88b49bbab23b216163bf0f6f03d065eef62237ab35be9dbb6755768d0b43a
openshift-hyperkube-4.1.14-201908290858.git.0.3bd3467.el8.x86_64.rpm SHA-256: dd9625a4bbee82a9ff870144d479b911f1372974d77898646846db1c55f63bf2

Red Hat OpenShift Container Platform 4.1 for RHEL 7

SRPM
atomic-enterprise-service-catalog-4.1.14-201908290858.git.1.28cc9ff.el7.src.rpm SHA-256: eb89e7957b90291b7a960d383f2401db465764db6940e3ca2cdefe3ab46a4977
openshift-4.1.14-201908290858.git.0.3bd3467.el7.src.rpm SHA-256: 8638d3635dbd7c34a8777724759a44ea3f17a297520ca8e357d57e909510895e
x86_64
atomic-enterprise-service-catalog-4.1.14-201908290858.git.1.28cc9ff.el7.x86_64.rpm SHA-256: 26c96963db37f1e348d784202a407eb90b5a98c6f49ad847e5a7a4f45c07c32c
atomic-enterprise-service-catalog-svcat-4.1.14-201908290858.git.1.28cc9ff.el7.x86_64.rpm SHA-256: 74494d69fb33eb743748ef4061be5074ebd7c63d18f0ab589d5c87a88959b1dc
openshift-clients-4.1.14-201908290858.git.0.3bd3467.el7.x86_64.rpm SHA-256: 60f78727d4a47e8fb6925ff8a8771a48361bcb8e15479ce328b7b557b848e25b
openshift-clients-redistributable-4.1.14-201908290858.git.0.3bd3467.el7.x86_64.rpm SHA-256: d2815d678bdb34578ef5cfbd4bcb48c543a247855916d1d7d15fe99b82624a5a
openshift-hyperkube-4.1.14-201908290858.git.0.3bd3467.el7.x86_64.rpm SHA-256: 0d3e460a97eea998d046be563f830c8320c52d2b301ddb2d28da68382d2b6af1

The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.