In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

An update of the kubernetes package has been released.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3193 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * kubernetes: Docker config secrets leaked when file is malformed and loglevel >= 4 (CVE-2020-8564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [3.11] Wrong message error displayed when creating a route with path based (BZ#1884421)

    * [3.11] passthrough route created using path (BZ#1884422)

    * Hawkular cassandra pod readiness probe failed when run on the CRIO node. (BZ#1958718)

    * Pods are getting stuck in ContainerCreating/ContainerCreateError/Terminating status (BZ#1965900)

    * [3.11.z] Egress IP iptables rules not added due to iptables: Resource temporarily unavailable     (BZ#1979216)

    * Slowness in services propagation after upgrading to v3.11.465 (BZ#1981736)

    * [3.11] NodePort is not working when configuring an egress IP address (BZ#1986413)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0172 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * kubernetes: Docker config secrets leaked when file is malformed and loglevel >= 4 (CVE-2020-8564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.6.13. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2021:0171

    All OpenShift Container Platform 4.6 users are advised to upgrade to these     updated packages and images when they are available in the appropriate     release channel. To check for available updates, use the OpenShift Console     or the CLI oc command. Instructions for upgrading a cluster are available     at     https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-between-     minor.html#understanding-upgrade-channels_updating-cluster-between-minor.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4297 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides     container runtime.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * jenkins-jira-plugin: plugin information disclosure (CVE-2019-16541)

    * jenkins-2-plugins/mailer: Missing hostname validation in Mailer Plugin could result in MITM     (CVE-2020-2252)

    * jenkins-2-plugins/blueocean: Path traversal vulnerability in Blue Ocean Plugin could allow to read     arbitrary files (CVE-2020-2254)

    * jenkins-2-plugins/blueocean: Blue Ocean Plugin does not perform permission checks in several HTTP     endpoints implementing connection tests. (CVE-2020-2255)

    * kubernetes: Docker config secrets leaked when file is malformed and loglevel >= 4 (CVE-2020-8564)

    * golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

    * podman: environment variables leak between containers when started via Varlink or Docker-compatible REST     API (CVE-2020-14370)

    * golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs     (CVE-2020-16845)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202902	Photon OS 1.0: Kubernetes PHSA-2021-1.0-0368	Nessus	PhotonOS Local Security Checks	medium
152832	RHEL 7 : OpenShift Container Platform 3.11.z (RHSA-2021:3193)	Nessus	Red Hat Local Security Checks	medium
147948	Photon OS 2.0: Kubernetes PHSA-2021-2.0-0326	Nessus	PhotonOS Local Security Checks	medium
146776	Photon OS 3.0: Kubernetes PHSA-2021-3.0-0196	Nessus	PhotonOS Local Security Checks	medium
145406	RHEL 7 / 8 : OpenShift Container Platform 4.6.13 (RHSA-2021:0172)	Nessus	Red Hat Local Security Checks	medium
142002	RHEL 7 / 8 : OpenShift Container Platform 4.6.1 (RHSA-2020:4297)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2020-8564

medium

Tenable Plugins

medium

medium

medium

medium

medium

critical