RHSA-2021:0308HighCVSS 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.6.16 security and bug fix update

Published
February 8, 2021
Last Modified
October 23, 2026

🔗 CVE IDs covered (3)

CVE-2016-2183 →CVE-2021-3344 →CVE-2021-20198 →

📋 Description

CVE-2016-2183 — SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) CVE-2021-3344 — openshift/builder: privilege escalation during container image builds via mounted secrets CVE-2021-20198 — openshift/installer: Bootstrap nodes allow anonymous authentication on kubelet port 10250

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:15dd3e3a1cfde520cc7da9c57292390446e359b3d1c416d7fdd84e5c30d94c09_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:91cf2976574bb5550f950073f0c4bde7f80c66549e5b18e7bc73007d071d32f9_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:b417eea4009c500effc1e11bcc66fc4ac1334708e9cbc0a67ba696d6948c6e2d_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:9d61a21d48eb771e90f5ed128eb42ecd90daf334f90676cab7c57a2e06146487_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:b1bb307ce990dd84d39cddbec634905d0ad4e352c627df7df92d2e14abfb4e7f_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:f5c72a30229993db04204c04b98b0241d2f774cd4e162ea6fb9e6b84bf367d91_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-aws-machine-controllers@sha256:f7d1dc09e3061dac704c65bf3d20fdac51239b7334ad4551c0731fc39e4073d8_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:6557c5d6c92d56f70fa218f420bff13d81101da75d211b057b55eb7da925723a_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:c82da3aa97cbc34bb7eec4903be3480f165783f798bff68d0ccafd4e38ea539f_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:d1b83fc9be0c56a5228a665b2650b04788b183a613b24cfcdb791da64fc8a387_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-azure-machine-controllers@sha256:d29b4fc60b9ae6b11aa1e3b2fc605b91178c2a6e70f576aba64989c8b597521d_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-baremetal-installer-rhel8@sha256:08193dbef7078c036d1a88b6ddbd3a1c94819ab5e69962f2be658b0b662586e8_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-baremetal-installer-rhel8@sha256:2cc73e8ddf4d46a8306d3a64711743650c9a372837eebc10689432aa48918bf5_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-baremetal-installer-rhel8@sha256:ded7909adfb34fbd75611af70b8715a6877d85dc865fd833e0a993df72eb81c9_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-baremetal-machine-controllers@sha256:03dc514e564643b520b3c28e53edd5f65e6a6d00dde63fc12eefd7ba70c61a39_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-baremetal-machine-controllers@sha256:33897d4da69c45786fa74b7db2b0bc30477c0c3de8664d077c57b48c42430f4d_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-baremetal-machine-controllers@sha256:a85d8ed0ff89f61484dc5aadb1a511649003c64da180fbff3948222468fcd51a_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-baremetal-rhel8-operator@sha256:2e630e7d5ad969181bbef578554451d38285a6af31de0197b92eb7a51d868f4e_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-baremetal-rhel8-operator@sha256:b369cd6b3619280dbdf73b3215fbc705eec5c5a16fb4c70b00f2a7f1a03f1023_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-baremetal-rhel8-operator@sha256:f8763ef2638cdbd023bedc9c63c33ba77612a082f658d5ca86a01b61e6ca694a_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-baremetal-runtimecfg-rhel8@sha256:3899b8fba1ab11d5cbff5581ca3bc7c06ba47eece58588cd53f93ead60e8ea4c_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-baremetal-runtimecfg-rhel8@sha256:6ed66a72f73663365275000f9e25d2f73396735b54332d6e94bc7713a14ed0b9_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-baremetal-runtimecfg-rhel8@sha256:b5a197f68fcac7fefb6e701ac2073c9eb8d2427aa8036abbd156241846e8af28_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cli-artifacts@sha256:36dbcf1b1c052cc45d88b34542c930da2e4b7215c6360e3768a63812b1dee985_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cli-artifacts@sha256:75f237fb87b4e370a719742f5de2d9f2d8ed0a048cd9d342f48f1ce14d88bffd_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cli-artifacts@sha256:ded8b6ff887828dfdf4fa1c5b184f8247e40cc0eb39b4e3b2dcaf85eb06db9d4_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cli@sha256:21d08b20bc5fba9f93ac98a2e81d933e3b0207d002bba0966e534625efcb3e09_amd64 as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cli@sha256:6014ef64a6526e1fceb20ba58cb3f7e3a09a39abdef6a07d6d7baedba8e37748_s390x as a component of Red Hat OpenShift Container Platform 4.6
  • openshift4/ose-cli@sha256:a546193ecca301413bfcd684b68f3fb7789306d8cb3678721ddbeb1a87287479_ppc64le as a component of Red Hat OpenShift Container Platform 4.6
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.6 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html. Workaround: 1.SSL/TLS configurations should prefer AES over DES. Versions of OpenSSL shipped with Red Hat Enterprise Linux 6 and 7 already do so. In the version of OpenSSL shipped with Red Hat Enterprise Linux 5, 3DES is listed below the AES-256 cipher and above the AES-128 cipher, therefore AES-256 based ciphersuite should not be disabled on the server. 2. Servers using OpenSSL, should not disable AES-128 and AES-256 ciphersuites. Versions of Apache shipped with Red Hat Enterprise Linux use the default cipher string, in which AES is preferred over DES/3DES based ciphersuites. For JBoss Middleware, and Java mitigations, please review this knowledge base article: https://access.redhat.com/articles/2598471 This can be mitigated on OpenShift Container Platform (OCP) by disabling the vulnerable TLS cipher suite in the applicable component. TLS configuration options for OCP are described here: https://access.redhat.com/articles/5348961 Workaround: The affected build strategies include docker, source and custom builds, hence these can be disabled as per the documentation[1]. This does however, exclude the Jenkins build strategy as it is not affected and does not have to be disabled. [1] https://docs.openshift.com/container-platform/4.6/builds/securing-builds-by-strategy.html On clusters where builds are allowed only grant permissions to perform builds to users who you wish to be to able to view, modify and edit all cluster resources. Workaround: This issue is mitigated by default on AWS, Azure, GCP and OpenStack as port 10250 is not remotely accessible on bootstrap nodes. For other IPI platforms, bootstrap nodes only exist during the installation window so the exposure is limited. For UPI installations, administrators should prevent remote access to this port on bootstrap nodes and/or remove the nodes once installation is complete

🔗 References (65)