Red Hat OpenShift: Mehrere Schwachstellen
WID-SEC-2026-4026 · first 28.10.2020 · updated 19.10.2026 · CVSS 10,0
What it is about
Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität zu gefährden.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- die Vertraulichkeit
- Verfügbarkeit
- Integrität zu gefährden
Am I affected?
Affected according to the BSI:
- Debian Linux
- Red Hat Enterprise Linux
- SUSE Linux
- Oracle Linux
- Red Hat OpenShift <4.6.1
- SUSE openSUSE
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Red Hat OpenShift 4.6.1
Is the vulnerability already being exploited?
- CVE-2020-11023: exploited in the wild according to CISA, in the catalogue since 23.01.2025.
- CVE-2019-8506: exploited in the wild according to CISA, in the catalogue since 04.05.2022.
Information and sources
- Original BSI advisory (WID)
- Red Hat Security Advisory RHSA-2021:0980 vom 2021-03-25 access.redhat.com
- Red Hat Security Advisory RHSA-2021:1129 vom 2021-04-08 access.redhat.com
- SUSE Security Update SUSE-SU-2021:1962-1 vom 2021-06-11 lists.suse.com
- Red Hat Security Advisory RHSA-2021:1168 vom 2021-04-13 access.redhat.com
- Red Hat Security Advisory RHSA-2020:4298 vom 2020-10-27 access.redhat.com
- Red Hat Security Advisory RHSA-2020:4847 vom 2020-11-04 access.redhat.com
- Red Hat Security Advisory RHSA-2020:4694 vom 2020-11-04 access.redhat.com
- Red Hat Security Advisory RHSA-2020:4682 vom 2020-11-04 access.redhat.com
- SUSE Security Update SUSE-SU-2020:3309-1 vom 2020-11-12 lists.suse.com
- Debian Security Advisory DLA-2453 vom 2020-11-16 lists.debian.org
- Debian Security Advisory DLA-2455 vom 2020-11-18 lists.debian.org
- Red Hat Security Advisory RHSA-2020:5249 vom 2020-11-30 access.redhat.com
- Red Hat Security Advisory RHSA-2020:5305 vom 2020-12-01 access.redhat.com
- Red Hat Security Advisory RHSA-2020:5533 vom 2020-12-15 access.redhat.com
- Red Hat Security Advisory RHSA-2020:5499 vom 2020-12-15 access.redhat.com
- Red Hat Security Advisory RHSA-2020:5581 vom 2020-12-16 access.redhat.com
- Oracle Linux Security Advisory ELSA-2020-5499 vom 2020-12-18 linux.oracle.com
- Red Hat Security Advisory RHSA-2021:0421 vom 2021-02-04 access.redhat.com
- Red Hat Security Advisory RHSA-2021:0521 vom 2021-02-15 access.redhat.com
- Red Hat Security Advisory RHSA-2021:0551 vom 2021-02-16 access.redhat.com
- Red Hat Security Advisory RHSA-2021:0548 vom 2021-02-16 access.redhat.com
- Red Hat Security Advisory RHSA-2021:0781 vom 2021-03-09 access.redhat.com
- Red Hat Security Advisory RHSA-2021:0799 vom 2021-03-10 access.redhat.com
- Red Hat Security Advisory RHSA-2021:2643 vom 2021-07-14 access.redhat.com
- Red Hat Security Advisory RHSA-2021:3140 vom 2021-08-11 access.redhat.com
and 3 more sources in the original advisory
CVE: CVE-2013-0169, CVE-2016-10739, CVE-2018-14404, CVE-2018-14498, CVE-2018-16890, CVE-2018-18074, CVE-2018-18624, CVE-2018-18751, CVE-2018-19519, CVE-2018-20060, CVE-2018-20337, CVE-2018-20483, CVE-2018-20657, CVE-2018-20852, CVE-2018-9251, CVE-2019-1010180, CVE-2019-1010204, CVE-2019-11070, CVE-2019-11236, CVE-2019-11324 …
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.