RHSA-2020:3369: Moderate: Red Hat OpenShift Service Mesh security update
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.Security Fix(es): golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic (CVE-2020-9283) nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203) jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023) macaron: open redirect in the static handler (CVE-2020-12666) golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:3369?
RHSA-2020:3369 is classified as a security vulnerability affecting certain versions of Red Hat OpenShift Service Mesh.
How do I fix RHSA-2020:3369?
To resolve RHSA-2020:3369, you should upgrade to the fixed versions specified in the advisory, such as 1.1.6-1.el8 for service mesh packages.
What software is affected by RHSA-2020:3369?
RHSA-2020:3369 affects multiple packages including servicemesh, servicemesh-grafana, and servicemesh-prometheus.
What is the primary issue in RHSA-2020:3369?
The primary issue in RHSA-2020:3369 involves the processing of crafted ssh-ed25519 public keys, which could lead to security risks.
Is there a workaround for RHSA-2020:3369?
No specific workaround for RHSA-2020:3369 is provided; updating to the latest versions is the recommended action.