Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

RedHat: RHSA-2020-0975-01 Moderate: OpenShift Service Mesh Security Issue

red hat
Calendar Grey March 25, 2020
Dist Redhat Esm H88
A security bulletin for Red Hat OpenShift Service Mesh version 1.0.10 has been released, highlighting a moderate risk security patch and associated remedies.
An update for openshift-istio-kiali-rhel7-operator-container is now available for Openshift Service Mesh 1.0

Solution

The OpenShift Service Mesh release notes provide information on the features and known issues:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.3/html/service_mesh/service-mesh-1-x

Summary

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
Security Fix(es):
* kiali: JWT cookie uses default signing key (CVE-2020-1764)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory moderate security issue red hat container openshift service mesh

References

https://access.redhat.com/security/cve/CVE-2020-1764 https://access.redhat.com/security/updates/classification/#moderate

Package List


Advisory ID: RHSA-2020:0975-01
Product: Red Hat OpenShift Service Mesh
Advisory URL: https://access.redhat.com/errata/RHSA-2020:0975
Issue date: 2020-03-25

Topic

An update for openshift-istio-kiali-rhel7-operator-container is nowavailable for Openshift Service Mesh 1.0.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate security issue red hat container openshift service mesh

Relevant Releases Architectures

Bugs Fixed

1810383 - CVE-2020-1764 kiali: JWT cookie uses default signing key

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here