RHSA-2020:2362MediumCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update

Published
June 2, 2020
Last Modified
October 20, 2026

🔗 CVE IDs covered (4)

CVE-2019-10744 →CVE-2020-7598 →CVE-2020-11022 →CVE-2020-12459 →

📋 Description

CVE-2019-10744 — nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties CVE-2020-7598 — nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload CVE-2020-11022 — jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method CVE-2020-12459 — grafana: information disclosure through world-readable grafana configuration files

🎯 Affected products9

  • OpenShift Service Mesh 1.0
  • Red Hat OpenShift Service Mesh 1.0
  • jaeger-0:v1.13.1.redhat7-1.el7.src as a component of Red Hat OpenShift Service Mesh 1.0
  • jaeger-0:v1.13.1.redhat7-1.el7.x86_64 as a component of Red Hat OpenShift Service Mesh 1.0
  • kiali-0:v1.0.11.redhat1-1.el7.src as a component of Red Hat OpenShift Service Mesh 1.0
  • kiali-0:v1.0.11.redhat1-1.el7.x86_64 as a component of Red Hat OpenShift Service Mesh 1.0
  • servicemesh-grafana-0:6.2.2-36.el8.src as a component of OpenShift Service Mesh 1.0
  • servicemesh-grafana-0:6.2.2-36.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64 as a component of OpenShift Service Mesh 1.0

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Manually change the files permission to remove readable bits for others: # chmod 640 /etc/grafana/grafana.ini /etc/grafana/ldap.toml

🔗 References (7)