Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
OpenShift Container Platform: Unauthorized Access to Cluster Resources
published 2 years ago
Summary
A security update is available for OpenShift Container Platform 4.10.25 to prevent unauthorized access to sensitive cluster resources. This update is essential for maintaining the security of your cluster. We recommend applying the update as soon as possible to ensure your cluster remains secure.
What to do
- Update redhat cri-tools to version 0:1.23.0-1.1.el7.
- Update redhat cri-tools-debuginfo to version 0:1.23.0-1.1.el7.
- Update redhat cri-tools to version 0:1.23.0-1.1.el8.
- Update redhat cri-tools-debuginfo to version 0:1.23.0-1.1.el8.
- Update redhat cri-tools-debugsource to version 0:1.23.0-1.1.el8.
- Update redhat cri-o to version 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el7.
- Update redhat cri-o-debuginfo to version 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el7.
- Update redhat cri-o to version 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el8.
- Update redhat cri-o-debuginfo to version 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el8.
- Update redhat cri-o-debugsource to version 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el8.
- Update redhat openshift to version 0:4.10.0-202207192015.p0.g012e945.assembly.stream.el7.
- Update redhat openshift-clients to version 0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el7.
- Update redhat openshift-clients-redistributable to version 0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el7.
- Update redhat openshift-hyperkube to version 0:4.10.0-202207192015.p0.g012e945.assembly.stream.el7.
- Update redhat atomic-openshift-service-idler to version 0:4.10.0-202207192015.p0.g39cfc66.assembly.stream.el8.
- Update redhat openshift to version 0:4.10.0-202207192015.p0.g012e945.assembly.stream.el8.
- Update redhat openshift-clients to version 0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el8.
- Update redhat openshift-clients-redistributable to version 0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el8.
- Update redhat openshift-hyperkube to version 0:4.10.0-202207192015.p0.g012e945.assembly.stream.el8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:openshift:4.10::el7 | redhat | cri-tools |
< 0:1.23.0-1.1.el7 Fix: upgrade to 0:1.23.0-1.1.el7
|
| Red Hat:openshift:4.10::el7 | redhat | cri-tools-debuginfo |
< 0:1.23.0-1.1.el7 Fix: upgrade to 0:1.23.0-1.1.el7
|
| Red Hat:openshift:4.10::el8 | redhat | cri-tools |
< 0:1.23.0-1.1.el8 Fix: upgrade to 0:1.23.0-1.1.el8
|
| Red Hat:openshift:4.10::el8 | redhat | cri-tools-debuginfo |
< 0:1.23.0-1.1.el8 Fix: upgrade to 0:1.23.0-1.1.el8
|
| Red Hat:openshift:4.10::el8 | redhat | cri-tools-debugsource |
< 0:1.23.0-1.1.el8 Fix: upgrade to 0:1.23.0-1.1.el8
|
| Red Hat:openshift:4.10::el7 | redhat | cri-o |
< 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el7 Fix: upgrade to 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el7
|
| Red Hat:openshift:4.10::el7 | redhat | cri-o-debuginfo |
< 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el7 Fix: upgrade to 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el7
|
| Red Hat:openshift:4.10::el8 | redhat | cri-o |
< 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el8 Fix: upgrade to 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el8
|
| Red Hat:openshift:4.10::el8 | redhat | cri-o-debuginfo |
< 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el8 Fix: upgrade to 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el8
|
| Red Hat:openshift:4.10::el8 | redhat | cri-o-debugsource |
< 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el8 Fix: upgrade to 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el8
|
| Red Hat:openshift:4.10::el7 | redhat | openshift |
< 0:4.10.0-202207192015.p0.g012e945.assembly.stream.el7 Fix: upgrade to 0:4.10.0-202207192015.p0.g012e945.assembly.stream.el7
|
| Red Hat:openshift:4.10::el7 | redhat | openshift-clients |
< 0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el7 Fix: upgrade to 0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el7
|
| Red Hat:openshift:4.10::el7 | redhat | openshift-clients-redistributable |
< 0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el7 Fix: upgrade to 0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el7
|
| Red Hat:openshift:4.10::el7 | redhat | openshift-hyperkube |
< 0:4.10.0-202207192015.p0.g012e945.assembly.stream.el7 Fix: upgrade to 0:4.10.0-202207192015.p0.g012e945.assembly.stream.el7
|
| Red Hat:openshift:4.10::el8 | redhat | atomic-openshift-service-idler |
< 0:4.10.0-202207192015.p0.g39cfc66.assembly.stream.el8 Fix: upgrade to 0:4.10.0-202207192015.p0.g39cfc66.assembly.stream.el8
|
| Red Hat:openshift:4.10::el8 | redhat | openshift |
< 0:4.10.0-202207192015.p0.g012e945.assembly.stream.el8 Fix: upgrade to 0:4.10.0-202207192015.p0.g012e945.assembly.stream.el8
|
| Red Hat:openshift:4.10::el8 | redhat | openshift-clients |
< 0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el8 Fix: upgrade to 0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el8
|
| Red Hat:openshift:4.10::el8 | redhat | openshift-clients-redistributable |
< 0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el8 Fix: upgrade to 0:4.10.0-202207192015.p0.g45460a5.assembly.stream.el8
|
| Red Hat:openshift:4.10::el8 | redhat | openshift-hyperkube |
< 0:4.10.0-202207192015.p0.g012e945.assembly.stream.el8 Fix: upgrade to 0:4.10.0-202207192015.p0.g012e945.assembly.stream.el8
|
Original advisory text
Red Hat Security Advisory: OpenShift Container Platform 4.10.25 security update
References
- https://access.redhat.com/errata/RHSA-2022:5729 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2064857 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2077688 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5729.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-23773 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2053541 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-23773 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-23773 Vendor Advisory
- https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-23806 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2053429 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-23806 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-23806 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-24675 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-24675 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-24675 Vendor Advisory
- https://groups.google.com/g/golang-announce/c/oecdBNLOml8 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-24921 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-24921 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-24921 Vendor Advisory
- https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-28327 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2077689 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-28327 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-28327 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-29526 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2084085 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-29526 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-29526 Vendor Advisory
- https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Sep 2024
Updated13 Mar 2026
First seen7 Mar 2026
Sources
RHSA-2022:5729 · OSV
Track software like this
Free during beta