In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

An update of the kubernetes package has been released.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5634 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.7.0. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2020:5633

    All OpenShift Container Platform 4.7 users are advised to upgrade to these     updated packages and images when they are available in the appropriate     release channel. To check for available updates, use the OpenShift Console     or the CLI oc command. Instructions for upgrading a cluster are available     at     https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-between-     minor.html#understanding-upgrade-channels_updating-cluster-between-minor.

    Security Fix(es):

    * gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

    * kubernetes: Ceph RBD adminSecrets exposed in logs when loglevel >= 4 (CVE-2020-8566)

    * containerd: credentials leak during image pull (CVE-2020-15157)

    * python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

    * atomic-openshift: cross-namespace owner references can trigger deletions of valid children     (CVE-2019-3884)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

= Required Actions

== Kubernetes & etcd (Security fixes)

This fix involves an upgrade of Kubernetes and some add-ons. See https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluste r_upd ates.html#_updating_kubernetes_components for the upgrade procedure.

== Skuba & helm/helm3

In order to update skuba and helm or helm 3, you need to update the management workstation. See detailed instructions at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluste r_upd ates.html#_update_management_workstation

= Known Issues

Modifying the file `/etc/sysconfig/kubelet` directly is not supported:
documentation at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_miscel laneo us.html#_configuring_kubelet

Be sure to check the Release Notes at https://www.suse.com/releasenotes/x86_64/SUSE-CAASP/4/#_changes_in_4_2
_4 for any additional known issues or behavioral changes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
202902	Photon OS 1.0: Kubernetes PHSA-2021-1.0-0368	Nessus	PhotonOS Local Security Checks	medium
147948	Photon OS 2.0: Kubernetes PHSA-2021-2.0-0326	Nessus	PhotonOS Local Security Checks	medium
146810	RHEL 7 / 8 : OpenShift Container Platform 4.7.0 (RHSA-2020:5634)	Nessus	Red Hat Local Security Checks	high
146776	Photon OS 3.0: Kubernetes PHSA-2021-3.0-0196	Nessus	PhotonOS Local Security Checks	medium
144173	SUSE SLES15 Security Update : Security changes in Kubernetes, etcd, / helm; Bugfix in cri-o package (SUSE-SU-2020:3760-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-8566

medium

Tenable Plugins

medium

medium

high

medium

medium