RHBA-2019:2581MediumCVSS 7.5

Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 images update

Published
September 3, 2019
Last Modified
October 23, 2026

🔗 CVE IDs covered (1)

CVE-2016-2183 →

📋 Description

CVE-2016-2183 — SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

🎯 Affected products154

  • Red Hat OpenShift Container Platform 3.11
  • openshift3/apb-base@sha256:763cc3daeb5d74f01fc4f0ae901f602a9e38204f3249386950ba1595b3f5db4a_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/apb-base@sha256:e552aab7947ceb3742f3edb0649222dab417fd94224926fcf6535efea3a49eab_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/apb-tools@sha256:16b6f591ef4b12426de75783812a183539dbfa610da1797491d381aaa16d6c10_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/apb-tools@sha256:fed26de0a6f33af0a7475e0eabfebb47aae5deb9e8e174b8442bf993edc3b82a_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/automation-broker-apb@sha256:74927207b9b2e8096c25a0bdd4970eff6b74308d490080b6a02f65a744b52df8_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/automation-broker-apb@sha256:a4aad2f41791ab0223c36ce9f1b353d45fc33104930d9dcf5e711df977c1e641_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/csi-attacher@sha256:854e60e8d6fc1ab8004bb6c0320df575a0e619ce0c57369817154d409019f7aa_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/csi-attacher@sha256:915953e86be37116879247233530e9f8d21db28c51f516bbc704bd5bd3d1bfd2_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/csi-driver-registrar@sha256:7388276b383db3b45c1fbdb4ec3266e41a566a8c612af37c8bfc3b63ae1ac556_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/csi-driver-registrar@sha256:f5ed23b537bd38c78a69cdc15fbfc8757dc1d93e4ec60c8e2e4b2c21177ed7e0_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/csi-livenessprobe@sha256:54724010d09ab5f14051e9f73f3d22bcd16cd2a0b4ddf79353f31fbe751e3192_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/csi-livenessprobe@sha256:800322bdfb2cf59aa0099a4ed4eac0e09b8b136ac4a12f1f07b0335fa69aa4d3_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/csi-provisioner@sha256:dda66e90ccc82eb56702147799e16ee5f0cf4e2076521440af21dd4f681de260_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/csi-provisioner@sha256:ee3c5a4f3dd01f0d977ea1d7af3426484ae4e75a64c5ad07ad06580b47389a23_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/grafana@sha256:502454641e5489c8552d1d8764f0533dc0accc1dc16a10a09347eb4f633fa51a_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/grafana@sha256:7440599d2b5acd01667c7c00d7b8eaad3cf6877ba079a6215ab0b5e19dba76f7_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/jenkins-slave-base-rhel7@sha256:0b0f03bbc5cdc30b870e53f4490ad445befb136fe86eae79386be6ebb2e3ac6e_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/jenkins-slave-base-rhel7@sha256:ffb1de34e6b5bdae5a144265f3de3617e7bff9ac1452189a6bbcc23adb987382_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/jenkins-slave-maven-rhel7@sha256:b98c1828d539b2309638d4cb0f3b08afbcf579af3d0dff6e5fc5abacd235b062_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/jenkins-slave-nodejs-rhel7@sha256:46b8a985339d1d1dda1d44aa9c5bc45a06582e705ddf8fb3191394b5e502c056_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/local-storage-provisioner@sha256:64567f985077b0e5ce3e12e9f43e5d4c434cbf3c93e02c3c9a2996c7b1121878_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/local-storage-provisioner@sha256:887b76eb8a94af76e9c17d261881c48fd3eb3c48e000cab4c617e46b10d44e7a_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/logging-fluentd@sha256:7e84289264cb9208276fd21f6cc16cb685cfa45ca4681a7a17da43cb8e275359_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/logging-fluentd@sha256:fe089baafe2523726dc129f6107f878fe0980df3c74ff6f275819045fda0f972_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/manila-provisioner@sha256:45450e8d0d57dad13598a88b0f48d4c1ccb4314a0945729b22d3623cae85e954_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/manila-provisioner@sha256:e22b20f538e6f322998bf7436c60b0171d9fbada1d04c404b8b7252e2e1603cc_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/mariadb-apb@sha256:0611c8cb9009c7de8f5c285f42b224109b7a54d5b674f61cb456890a912c9bc1_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/mariadb-apb@sha256:98fd26d9468f1532bea988ddd1be7cc924b1d2f30c8275947450cef7cb8a21ce_ppc64le as a component of Red Hat OpenShift Container Platform 3.11
  • openshift3/mediawiki-apb@sha256:3434e58781a78e47a8695a23c3d21c50b3292a3451e680bd0608d434089f7777_amd64 as a component of Red Hat OpenShift Container Platform 3.11
  • +124 more not shown

✅ Remediation

Before applying this update, ensure all previously released errata relevant to your system have been applied. For OpenShift Container Platform 3.11 see the following documentation, which will be updated shortly for release 3.11.141, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258. Workaround: 1.SSL/TLS configurations should prefer AES over DES. Versions of OpenSSL shipped with Red Hat Enterprise Linux 6 and 7 already do so. In the version of OpenSSL shipped with Red Hat Enterprise Linux 5, 3DES is listed below the AES-256 cipher and above the AES-128 cipher, therefore AES-256 based ciphersuite should not be disabled on the server. 2. Servers using OpenSSL, should not disable AES-128 and AES-256 ciphersuites. Versions of Apache shipped with Red Hat Enterprise Linux use the default cipher string, in which AES is preferred over DES/3DES based ciphersuites. For JBoss Middleware, and Java mitigations, please review this knowledge base article: https://access.redhat.com/articles/2598471 This can be mitigated on OpenShift Container Platform (OCP) by disabling the vulnerable TLS cipher suite in the applicable component. TLS configuration options for OCP are described here: https://access.redhat.com/articles/5348961

🔗 References (3)