{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_vex", "csaf_version": "2.0", "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "title": "Egress Firewall does not reliably apply firewall rules", "tracking": { "current_release_date": "2026-07-25T10:01:48+00:00", "generator": { "date": "2026-07-25T10:01:48+00:00", "engine": { "name": "CSAF Generator", "version": "3.1.0" } }, "id": "CVE-2021-3499", "initial_release_date": "2021-04-14T00:00:00+00:00", "revision_history": [ { "date": "2026-07-25T10:01:48+00:00", "number": "1", "summary": "Last generated version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "category": "vendor", "name": "Red Hat", "branches": [ { "category": "product_name", "name": "OpenShift Container Platform 4.7", "product": { "name": "OpenShift Container Platform 4.7", "product_id": "openshift-4.7.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.7", "product": { "name": "OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.7::el8" } } }, { "category": "product_version", "name": "cluster-etcd-operator-container-v4.7.0", "product": { "name": "cluster-etcd-operator-container-v4.7.0", "product_id": "cluster-etcd-operator-container-v4.7.0-0:202105072257.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/cluster-etcd-operator-container-v4.7.0@202105072257.p0?epoch=0" } } }, { "category": "product_version", "name": "cluster-network-operator-container-v4.7.0", "product": { "name": "cluster-network-operator-container-v4.7.0", "product_id": "cluster-network-operator-container-v4.7.0-0:202105071917.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/cluster-network-operator-container-v4.7.0@202105071917.p0?epoch=0" } } }, { "category": "product_version", "name": "driver-toolkit-container-v4.7.0", "product": { "name": "driver-toolkit-container-v4.7.0", "product_id": "driver-toolkit-container-v4.7.0-0:202105102252.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/driver-toolkit-container-v4.7.0@202105102252.p0?epoch=0" } } }, { "category": "product_version", "name": "ironic-container-v4.7.0", "product": { "name": "ironic-container-v4.7.0", "product_id": "ironic-container-v4.7.0-0:202105111107.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ironic-container-v4.7.0@202105111107.p0?epoch=0" } } }, { "category": "product_version", "name": "kuryr-cni-container-v4.7.0", "product": { "name": "kuryr-cni-container-v4.7.0", "product_id": "kuryr-cni-container-v4.7.0-0:202105111940.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/kuryr-cni-container-v4.7.0@202105111940.p0?epoch=0" } } }, { "category": "product_version", "name": "kuryr-controller-container-v4.7.0", "product": { "name": "kuryr-controller-container-v4.7.0", "product_id": "kuryr-controller-container-v4.7.0-0:202105111940.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/kuryr-controller-container-v4.7.0@202105111940.p0?epoch=0" } } }, { "category": "product_version", "name": "openshift-enterprise-builder-container-v4.7.0", "product": { "name": "openshift-enterprise-builder-container-v4.7.0", "product_id": "openshift-enterprise-builder-container-v4.7.0-0:202105060839.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-enterprise-builder-container-v4.7.0@202105060839.p0?epoch=0" } } }, { "category": "product_version", "name": "openshift-enterprise-console-container-v4.7.0", "product": { "name": "openshift-enterprise-console-container-v4.7.0", "product_id": "openshift-enterprise-console-container-v4.7.0-0:202105070703.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-enterprise-console-container-v4.7.0@202105070703.p0?epoch=0" } } }, { "category": "product_version", "name": "openshift-enterprise-hyperkube-container-v4.7.0", "product": { "name": "openshift-enterprise-hyperkube-container-v4.7.0", "product_id": "openshift-enterprise-hyperkube-container-v4.7.0-0:202105091821.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-enterprise-hyperkube-container-v4.7.0@202105091821.p0?epoch=0" } } }, { "category": "product_version", "name": "openshift-enterprise-tests-container-v4.7.0", "product": { "name": "openshift-enterprise-tests-container-v4.7.0", "product_id": "openshift-enterprise-tests-container-v4.7.0-0:202105110735.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-enterprise-tests-container-v4.7.0@202105110735.p0?epoch=0" } } }, { "category": "product_version", "name": "openshift-jenkins", "product": { "name": "openshift-jenkins", "product_id": "openshift-jenkins-0:2-container-v4.7.0-202105071334.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-jenkins@2-container-v4.7.0-202105071334.p0?epoch=0" } } }, { "category": "product_version", "name": "openshift4/ose-thanos-rhel8", "product": { "name": "openshift4/ose-thanos-rhel8", "product_id": "openshift4/ose-thanos-rhel8", "product_identification_helper": { "purl": "pkg:oci/ose-thanos-rhel8?repository_url=registry.redhat.io/openshift4/ose-thanos-rhel8" } } }, { "category": "product_version", "name": "operator-lifecycle-manager-container-v4.7.0", "product": { "name": "operator-lifecycle-manager-container-v4.7.0", "product_id": "operator-lifecycle-manager-container-v4.7.0-0:202104300003.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/operator-lifecycle-manager-container-v4.7.0@202104300003.p0?epoch=0" } } }, { "category": "product_version", "name": "operator-registry-container-v4.7.0", "product": { "name": "operator-registry-container-v4.7.0", "product_id": "operator-registry-container-v4.7.0-0:202104292145.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/operator-registry-container-v4.7.0@202104292145.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-aws-machine-controllers-container-v4.7.0", "product": { "name": "ose-aws-machine-controllers-container-v4.7.0", "product_id": "ose-aws-machine-controllers-container-v4.7.0-0:202105010012.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-aws-machine-controllers-container-v4.7.0@202105010012.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-baremetal-installer-container-v4.7.0", "product": { "name": "ose-baremetal-installer-container-v4.7.0", "product_id": "ose-baremetal-installer-container-v4.7.0-0:202105101449.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-baremetal-installer-container-v4.7.0@202105101449.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-cloud-credential-operator-container-v4.7.0", "product": { "name": "ose-cloud-credential-operator-container-v4.7.0", "product_id": "ose-cloud-credential-operator-container-v4.7.0-0:202105061841.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-cloud-credential-operator-container-v4.7.0@202105061841.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-cluster-authentication-operator-container-v4.7.0", "product": { "name": "ose-cluster-authentication-operator-container-v4.7.0", "product_id": "ose-cluster-authentication-operator-container-v4.7.0-0:202105061754.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-cluster-authentication-operator-container-v4.7.0@202105061754.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-cluster-config-operator-container-v4.7.0", "product": { "name": "ose-cluster-config-operator-container-v4.7.0", "product_id": "ose-cluster-config-operator-container-v4.7.0-0:202104291920.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-cluster-config-operator-container-v4.7.0@202104291920.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-cluster-dns-operator-container-v4.7.0", "product": { "name": "ose-cluster-dns-operator-container-v4.7.0", "product_id": "ose-cluster-dns-operator-container-v4.7.0-0:202104292145.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-cluster-dns-operator-container-v4.7.0@202104292145.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-cluster-image-registry-operator-container-v4.7.0", "product": { "name": "ose-cluster-image-registry-operator-container-v4.7.0", "product_id": "ose-cluster-image-registry-operator-container-v4.7.0-0:202104302340.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-cluster-image-registry-operator-container-v4.7.0@202104302340.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-cluster-ingress-operator-container-v4.7.0", "product": { "name": "ose-cluster-ingress-operator-container-v4.7.0", "product_id": "ose-cluster-ingress-operator-container-v4.7.0-0:202104291920.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-cluster-ingress-operator-container-v4.7.0@202104291920.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-cluster-openshift-apiserver-operator-container-v4.7.0", "product": { "name": "ose-cluster-openshift-apiserver-operator-container-v4.7.0", "product_id": "ose-cluster-openshift-apiserver-operator-container-v4.7.0-0:202105061841.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-cluster-openshift-apiserver-operator-container-v4.7.0@202105061841.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-cluster-update-keys-container-v4.7.0", "product": { "name": "ose-cluster-update-keys-container-v4.7.0", "product_id": "ose-cluster-update-keys-container-v4.7.0-0:202105060839.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-cluster-update-keys-container-v4.7.0@202105060839.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-gcp-pd-csi-driver-operator-container-v4.7.0", "product": { "name": "ose-gcp-pd-csi-driver-operator-container-v4.7.0", "product_id": "ose-gcp-pd-csi-driver-operator-container-v4.7.0-0:202104290851.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-gcp-pd-csi-driver-operator-container-v4.7.0@202104290851.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-hello-openshift-container-v4.7.0", "product": { "name": "ose-hello-openshift-container-v4.7.0", "product_id": "ose-hello-openshift-container-v4.7.0-0:202105071232.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-hello-openshift-container-v4.7.0@202105071232.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-insights-operator-container-v4.7.0", "product": { "name": "ose-insights-operator-container-v4.7.0", "product_id": "ose-insights-operator-container-v4.7.0-0:202105062344.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-insights-operator-container-v4.7.0@202105062344.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-installer-artifacts-container-v4.7.0", "product": { "name": "ose-installer-artifacts-container-v4.7.0", "product_id": "ose-installer-artifacts-container-v4.7.0-0:202105101449.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-installer-artifacts-container-v4.7.0@202105101449.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-installer-container-v4.7.0", "product": { "name": "ose-installer-container-v4.7.0", "product_id": "ose-installer-container-v4.7.0-0:202105101449.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-installer-container-v4.7.0@202105101449.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-jenkins-agent-base-container-v4.7.0", "product": { "name": "ose-jenkins-agent-base-container-v4.7.0", "product_id": "ose-jenkins-agent-base-container-v4.7.0-0:202105062344.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-jenkins-agent-base-container-v4.7.0@202105062344.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-jenkins-agent-maven-container-v4.7.0", "product": { "name": "ose-jenkins-agent-maven-container-v4.7.0", "product_id": "ose-jenkins-agent-maven-container-v4.7.0-0:202105062344.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-jenkins-agent-maven-container-v4.7.0@202105062344.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-jenkins-agent-nodejs", "product": { "name": "ose-jenkins-agent-nodejs", "product_id": "ose-jenkins-agent-nodejs-0:12-container-v4.7.0-202105062344.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-jenkins-agent-nodejs@12-container-v4.7.0-202105062344.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-machine-api-operator-container-v4.7.0", "product": { "name": "ose-machine-api-operator-container-v4.7.0", "product_id": "ose-machine-api-operator-container-v4.7.0-0:202105071028.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-machine-api-operator-container-v4.7.0@202105071028.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-machine-config-operator-container-v4.7.0", "product": { "name": "ose-machine-config-operator-container-v4.7.0", "product_id": "ose-machine-config-operator-container-v4.7.0-0:202105111858.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-machine-config-operator-container-v4.7.0@202105111858.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-node-container-v4.7.0", "product": { "name": "ose-node-container-v4.7.0", "product_id": "ose-node-container-v4.7.0-0:202104280847.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-node-container-v4.7.0@202104280847.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-ovn-kubernetes-container-v4.7.0", "product": { "name": "ose-ovn-kubernetes-container-v4.7.0", "product_id": "ose-ovn-kubernetes-container-v4.7.0-0:202105071917.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-ovn-kubernetes-container-v4.7.0@202105071917.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-thanos-container-v4.7.0", "product": { "name": "ose-thanos-container-v4.7.0", "product_id": "ose-thanos-container-v4.7.0-0:202105061841.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-thanos-container-v4.7.0@202105061841.p0?epoch=0" } } } ] } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "cluster-etcd-operator-container-v4.7.0-0:202105072257.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:cluster-etcd-operator-container-v4.7.0-0:202105072257.p0" }, "product_reference": "cluster-etcd-operator-container-v4.7.0-0:202105072257.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "cluster-network-operator-container-v4.7.0-0:202105071917.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:cluster-network-operator-container-v4.7.0-0:202105071917.p0" }, "product_reference": "cluster-network-operator-container-v4.7.0-0:202105071917.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "driver-toolkit-container-v4.7.0-0:202105102252.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:driver-toolkit-container-v4.7.0-0:202105102252.p0" }, "product_reference": "driver-toolkit-container-v4.7.0-0:202105102252.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ironic-container-v4.7.0-0:202105111107.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ironic-container-v4.7.0-0:202105111107.p0" }, "product_reference": "ironic-container-v4.7.0-0:202105111107.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "kuryr-cni-container-v4.7.0-0:202105111940.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:kuryr-cni-container-v4.7.0-0:202105111940.p0" }, "product_reference": "kuryr-cni-container-v4.7.0-0:202105111940.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "kuryr-controller-container-v4.7.0-0:202105111940.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:kuryr-controller-container-v4.7.0-0:202105111940.p0" }, "product_reference": "kuryr-controller-container-v4.7.0-0:202105111940.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-enterprise-builder-container-v4.7.0-0:202105060839.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:openshift-enterprise-builder-container-v4.7.0-0:202105060839.p0" }, "product_reference": "openshift-enterprise-builder-container-v4.7.0-0:202105060839.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-enterprise-console-container-v4.7.0-0:202105070703.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:openshift-enterprise-console-container-v4.7.0-0:202105070703.p0" }, "product_reference": "openshift-enterprise-console-container-v4.7.0-0:202105070703.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-enterprise-hyperkube-container-v4.7.0-0:202105091821.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:openshift-enterprise-hyperkube-container-v4.7.0-0:202105091821.p0" }, "product_reference": "openshift-enterprise-hyperkube-container-v4.7.0-0:202105091821.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-enterprise-tests-container-v4.7.0-0:202105110735.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:openshift-enterprise-tests-container-v4.7.0-0:202105110735.p0" }, "product_reference": "openshift-enterprise-tests-container-v4.7.0-0:202105110735.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-jenkins-0:2-container-v4.7.0-202105071334.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:openshift-jenkins-0:2-container-v4.7.0-202105071334.p0" }, "product_reference": "openshift-jenkins-0:2-container-v4.7.0-202105071334.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-thanos-rhel8 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7.z:openshift4/ose-thanos-rhel8" }, "product_reference": "openshift4/ose-thanos-rhel8", "relates_to_product_reference": "openshift-4.7.z" }, { "category": "default_component_of", "full_product_name": { "name": "operator-lifecycle-manager-container-v4.7.0-0:202104300003.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:operator-lifecycle-manager-container-v4.7.0-0:202104300003.p0" }, "product_reference": "operator-lifecycle-manager-container-v4.7.0-0:202104300003.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "operator-registry-container-v4.7.0-0:202104292145.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:operator-registry-container-v4.7.0-0:202104292145.p0" }, "product_reference": "operator-registry-container-v4.7.0-0:202104292145.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-aws-machine-controllers-container-v4.7.0-0:202105010012.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-aws-machine-controllers-container-v4.7.0-0:202105010012.p0" }, "product_reference": "ose-aws-machine-controllers-container-v4.7.0-0:202105010012.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-baremetal-installer-container-v4.7.0-0:202105101449.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-baremetal-installer-container-v4.7.0-0:202105101449.p0" }, "product_reference": "ose-baremetal-installer-container-v4.7.0-0:202105101449.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-cloud-credential-operator-container-v4.7.0-0:202105061841.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-cloud-credential-operator-container-v4.7.0-0:202105061841.p0" }, "product_reference": "ose-cloud-credential-operator-container-v4.7.0-0:202105061841.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-cluster-authentication-operator-container-v4.7.0-0:202105061754.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-cluster-authentication-operator-container-v4.7.0-0:202105061754.p0" }, "product_reference": "ose-cluster-authentication-operator-container-v4.7.0-0:202105061754.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-cluster-config-operator-container-v4.7.0-0:202104291920.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-cluster-config-operator-container-v4.7.0-0:202104291920.p0" }, "product_reference": "ose-cluster-config-operator-container-v4.7.0-0:202104291920.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-cluster-dns-operator-container-v4.7.0-0:202104292145.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-cluster-dns-operator-container-v4.7.0-0:202104292145.p0" }, "product_reference": "ose-cluster-dns-operator-container-v4.7.0-0:202104292145.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-cluster-image-registry-operator-container-v4.7.0-0:202104302340.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-cluster-image-registry-operator-container-v4.7.0-0:202104302340.p0" }, "product_reference": "ose-cluster-image-registry-operator-container-v4.7.0-0:202104302340.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-cluster-ingress-operator-container-v4.7.0-0:202104291920.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-cluster-ingress-operator-container-v4.7.0-0:202104291920.p0" }, "product_reference": "ose-cluster-ingress-operator-container-v4.7.0-0:202104291920.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-cluster-openshift-apiserver-operator-container-v4.7.0-0:202105061841.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-cluster-openshift-apiserver-operator-container-v4.7.0-0:202105061841.p0" }, "product_reference": "ose-cluster-openshift-apiserver-operator-container-v4.7.0-0:202105061841.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-cluster-update-keys-container-v4.7.0-0:202105060839.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-cluster-update-keys-container-v4.7.0-0:202105060839.p0" }, "product_reference": "ose-cluster-update-keys-container-v4.7.0-0:202105060839.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-gcp-pd-csi-driver-operator-container-v4.7.0-0:202104290851.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-gcp-pd-csi-driver-operator-container-v4.7.0-0:202104290851.p0" }, "product_reference": "ose-gcp-pd-csi-driver-operator-container-v4.7.0-0:202104290851.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-hello-openshift-container-v4.7.0-0:202105071232.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-hello-openshift-container-v4.7.0-0:202105071232.p0" }, "product_reference": "ose-hello-openshift-container-v4.7.0-0:202105071232.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-insights-operator-container-v4.7.0-0:202105062344.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-insights-operator-container-v4.7.0-0:202105062344.p0" }, "product_reference": "ose-insights-operator-container-v4.7.0-0:202105062344.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-installer-artifacts-container-v4.7.0-0:202105101449.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-installer-artifacts-container-v4.7.0-0:202105101449.p0" }, "product_reference": "ose-installer-artifacts-container-v4.7.0-0:202105101449.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-installer-container-v4.7.0-0:202105101449.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-installer-container-v4.7.0-0:202105101449.p0" }, "product_reference": "ose-installer-container-v4.7.0-0:202105101449.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-jenkins-agent-base-container-v4.7.0-0:202105062344.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-jenkins-agent-base-container-v4.7.0-0:202105062344.p0" }, "product_reference": "ose-jenkins-agent-base-container-v4.7.0-0:202105062344.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-jenkins-agent-maven-container-v4.7.0-0:202105062344.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-jenkins-agent-maven-container-v4.7.0-0:202105062344.p0" }, "product_reference": "ose-jenkins-agent-maven-container-v4.7.0-0:202105062344.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-jenkins-agent-nodejs-0:12-container-v4.7.0-202105062344.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-jenkins-agent-nodejs-0:12-container-v4.7.0-202105062344.p0" }, "product_reference": "ose-jenkins-agent-nodejs-0:12-container-v4.7.0-202105062344.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-machine-api-operator-container-v4.7.0-0:202105071028.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-machine-api-operator-container-v4.7.0-0:202105071028.p0" }, "product_reference": "ose-machine-api-operator-container-v4.7.0-0:202105071028.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-machine-config-operator-container-v4.7.0-0:202105111858.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-machine-config-operator-container-v4.7.0-0:202105111858.p0" }, "product_reference": "ose-machine-config-operator-container-v4.7.0-0:202105111858.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-node-container-v4.7.0-0:202104280847.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-node-container-v4.7.0-0:202104280847.p0" }, "product_reference": "ose-node-container-v4.7.0-0:202104280847.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-ovn-kubernetes-container-v4.7.0-0:202105071917.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-ovn-kubernetes-container-v4.7.0-0:202105071917.p0" }, "product_reference": "ose-ovn-kubernetes-container-v4.7.0-0:202105071917.p0", "relates_to_product_reference": "openshift-4.7::el8" }, { "category": "default_component_of", "full_product_name": { "name": "ose-thanos-container-v4.7.0-0:202105061841.p0 as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7::el8:ose-thanos-container-v4.7.0-0:202105061841.p0" }, "product_reference": "ose-thanos-container-v4.7.0-0:202105061841.p0", "relates_to_product_reference": "openshift-4.7::el8" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3499", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2021-04-13T00:00:00+00:00", "notes": [ { "category": "other", "text": "In OpenShift Container Platform 4 the default Container Network Interface (CNI) network provider plug-in is OpenShift SDN, and it's not affected by this flaw. Only the OVN-Kubernetes CNI network provider is affected.", "title": "Statement" }, { "category": "description", "text": "A vulnerability was found in OVN Kubernetes where the Egress Firewall does not reliably apply firewall rules when there is multiple dns rules.\r\nIt could lead to potentially lose of confidentiality, integrity or availability of a service.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "openshift-4.7::el8:cluster-etcd-operator-container-v4.7.0-0:202105072257.p0", "openshift-4.7::el8:cluster-network-operator-container-v4.7.0-0:202105071917.p0", "openshift-4.7::el8:driver-toolkit-container-v4.7.0-0:202105102252.p0", "openshift-4.7::el8:ironic-container-v4.7.0-0:202105111107.p0", "openshift-4.7::el8:kuryr-cni-container-v4.7.0-0:202105111940.p0", "openshift-4.7::el8:kuryr-controller-container-v4.7.0-0:202105111940.p0", "openshift-4.7::el8:openshift-enterprise-builder-container-v4.7.0-0:202105060839.p0", "openshift-4.7::el8:openshift-enterprise-console-container-v4.7.0-0:202105070703.p0", "openshift-4.7::el8:openshift-enterprise-hyperkube-container-v4.7.0-0:202105091821.p0", "openshift-4.7::el8:openshift-enterprise-tests-container-v4.7.0-0:202105110735.p0", "openshift-4.7::el8:openshift-jenkins-0:2-container-v4.7.0-202105071334.p0", "openshift-4.7::el8:operator-lifecycle-manager-container-v4.7.0-0:202104300003.p0", "openshift-4.7::el8:operator-registry-container-v4.7.0-0:202104292145.p0", "openshift-4.7::el8:ose-aws-machine-controllers-container-v4.7.0-0:202105010012.p0", "openshift-4.7::el8:ose-baremetal-installer-container-v4.7.0-0:202105101449.p0", "openshift-4.7::el8:ose-cloud-credential-operator-container-v4.7.0-0:202105061841.p0", "openshift-4.7::el8:ose-cluster-authentication-operator-container-v4.7.0-0:202105061754.p0", "openshift-4.7::el8:ose-cluster-config-operator-container-v4.7.0-0:202104291920.p0", "openshift-4.7::el8:ose-cluster-dns-operator-container-v4.7.0-0:202104292145.p0", "openshift-4.7::el8:ose-cluster-image-registry-operator-container-v4.7.0-0:202104302340.p0", "openshift-4.7::el8:ose-cluster-ingress-operator-container-v4.7.0-0:202104291920.p0", "openshift-4.7::el8:ose-cluster-openshift-apiserver-operator-container-v4.7.0-0:202105061841.p0", "openshift-4.7::el8:ose-cluster-update-keys-container-v4.7.0-0:202105060839.p0", "openshift-4.7::el8:ose-gcp-pd-csi-driver-operator-container-v4.7.0-0:202104290851.p0", "openshift-4.7::el8:ose-hello-openshift-container-v4.7.0-0:202105071232.p0", "openshift-4.7::el8:ose-insights-operator-container-v4.7.0-0:202105062344.p0", "openshift-4.7::el8:ose-installer-artifacts-container-v4.7.0-0:202105101449.p0", "openshift-4.7::el8:ose-installer-container-v4.7.0-0:202105101449.p0", "openshift-4.7::el8:ose-jenkins-agent-base-container-v4.7.0-0:202105062344.p0", "openshift-4.7::el8:ose-jenkins-agent-maven-container-v4.7.0-0:202105062344.p0", "openshift-4.7::el8:ose-jenkins-agent-nodejs-0:12-container-v4.7.0-202105062344.p0", "openshift-4.7::el8:ose-machine-api-operator-container-v4.7.0-0:202105071028.p0", "openshift-4.7::el8:ose-machine-config-operator-container-v4.7.0-0:202105111858.p0", "openshift-4.7::el8:ose-node-container-v4.7.0-0:202104280847.p0", "openshift-4.7::el8:ose-ovn-kubernetes-container-v4.7.0-0:202105071917.p0", "openshift-4.7::el8:ose-thanos-container-v4.7.0-0:202105061841.p0" ], "known_affected": [ "openshift-4.7.z:openshift4/ose-thanos-rhel8" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3499" }, { "category": "external", "summary": "nvd.nist.gov", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3499" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3499" } ], "remediations": [ { "category": "none_available", "details": "Affected", "product_ids": [ "openshift-4.7.z:openshift4/ose-thanos-rhel8" ] }, { "category": "vendor_fix", "date": "2021-05-19T15:15:06+00:00", "details": "Apply advisory RHBA-2021:1550 as per vendors instructions.", "product_ids": [ "openshift-4.7::el8:cluster-etcd-operator-container-v4.7.0-0:202105072257.p0", "openshift-4.7::el8:cluster-network-operator-container-v4.7.0-0:202105071917.p0", "openshift-4.7::el8:driver-toolkit-container-v4.7.0-0:202105102252.p0", "openshift-4.7::el8:ironic-container-v4.7.0-0:202105111107.p0", "openshift-4.7::el8:kuryr-cni-container-v4.7.0-0:202105111940.p0", "openshift-4.7::el8:kuryr-controller-container-v4.7.0-0:202105111940.p0", "openshift-4.7::el8:openshift-enterprise-builder-container-v4.7.0-0:202105060839.p0", "openshift-4.7::el8:openshift-enterprise-console-container-v4.7.0-0:202105070703.p0", "openshift-4.7::el8:openshift-enterprise-hyperkube-container-v4.7.0-0:202105091821.p0", "openshift-4.7::el8:openshift-enterprise-tests-container-v4.7.0-0:202105110735.p0", "openshift-4.7::el8:openshift-jenkins-0:2-container-v4.7.0-202105071334.p0", "openshift-4.7::el8:operator-lifecycle-manager-container-v4.7.0-0:202104300003.p0", "openshift-4.7::el8:operator-registry-container-v4.7.0-0:202104292145.p0", "openshift-4.7::el8:ose-aws-machine-controllers-container-v4.7.0-0:202105010012.p0", "openshift-4.7::el8:ose-baremetal-installer-container-v4.7.0-0:202105101449.p0", "openshift-4.7::el8:ose-cloud-credential-operator-container-v4.7.0-0:202105061841.p0", "openshift-4.7::el8:ose-cluster-authentication-operator-container-v4.7.0-0:202105061754.p0", "openshift-4.7::el8:ose-cluster-config-operator-container-v4.7.0-0:202104291920.p0", "openshift-4.7::el8:ose-cluster-dns-operator-container-v4.7.0-0:202104292145.p0", "openshift-4.7::el8:ose-cluster-image-registry-operator-container-v4.7.0-0:202104302340.p0", "openshift-4.7::el8:ose-cluster-ingress-operator-container-v4.7.0-0:202104291920.p0", "openshift-4.7::el8:ose-cluster-openshift-apiserver-operator-container-v4.7.0-0:202105061841.p0", "openshift-4.7::el8:ose-cluster-update-keys-container-v4.7.0-0:202105060839.p0", "openshift-4.7::el8:ose-gcp-pd-csi-driver-operator-container-v4.7.0-0:202104290851.p0", "openshift-4.7::el8:ose-hello-openshift-container-v4.7.0-0:202105071232.p0", "openshift-4.7::el8:ose-insights-operator-container-v4.7.0-0:202105062344.p0", "openshift-4.7::el8:ose-installer-artifacts-container-v4.7.0-0:202105101449.p0", "openshift-4.7::el8:ose-installer-container-v4.7.0-0:202105101449.p0", "openshift-4.7::el8:ose-jenkins-agent-base-container-v4.7.0-0:202105062344.p0", "openshift-4.7::el8:ose-jenkins-agent-maven-container-v4.7.0-0:202105062344.p0", "openshift-4.7::el8:ose-jenkins-agent-nodejs-0:12-container-v4.7.0-202105062344.p0", "openshift-4.7::el8:ose-machine-api-operator-container-v4.7.0-0:202105071028.p0", "openshift-4.7::el8:ose-machine-config-operator-container-v4.7.0-0:202105111858.p0", "openshift-4.7::el8:ose-node-container-v4.7.0-0:202104280847.p0", "openshift-4.7::el8:ose-ovn-kubernetes-container-v4.7.0-0:202105071917.p0", "openshift-4.7::el8:ose-thanos-container-v4.7.0-0:202105061841.p0" ], "url": "https://access.redhat.com/errata/RHBA-2021:1550" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 5.6, "baseSeverity": "MEDIUM" }, "products": [ "openshift-4.7.z:openshift4/ose-thanos-rhel8", "openshift-4.7::el8:cluster-etcd-operator-container-v4.7.0-0:202105072257.p0", "openshift-4.7::el8:cluster-network-operator-container-v4.7.0-0:202105071917.p0", "openshift-4.7::el8:driver-toolkit-container-v4.7.0-0:202105102252.p0", "openshift-4.7::el8:ironic-container-v4.7.0-0:202105111107.p0", "openshift-4.7::el8:kuryr-cni-container-v4.7.0-0:202105111940.p0", "openshift-4.7::el8:kuryr-controller-container-v4.7.0-0:202105111940.p0", "openshift-4.7::el8:openshift-enterprise-builder-container-v4.7.0-0:202105060839.p0", "openshift-4.7::el8:openshift-enterprise-console-container-v4.7.0-0:202105070703.p0", "openshift-4.7::el8:openshift-enterprise-hyperkube-container-v4.7.0-0:202105091821.p0", "openshift-4.7::el8:openshift-enterprise-tests-container-v4.7.0-0:202105110735.p0", "openshift-4.7::el8:openshift-jenkins-0:2-container-v4.7.0-202105071334.p0", "openshift-4.7::el8:operator-lifecycle-manager-container-v4.7.0-0:202104300003.p0", "openshift-4.7::el8:operator-registry-container-v4.7.0-0:202104292145.p0", "openshift-4.7::el8:ose-aws-machine-controllers-container-v4.7.0-0:202105010012.p0", "openshift-4.7::el8:ose-baremetal-installer-container-v4.7.0-0:202105101449.p0", "openshift-4.7::el8:ose-cloud-credential-operator-container-v4.7.0-0:202105061841.p0", "openshift-4.7::el8:ose-cluster-authentication-operator-container-v4.7.0-0:202105061754.p0", "openshift-4.7::el8:ose-cluster-config-operator-container-v4.7.0-0:202104291920.p0", "openshift-4.7::el8:ose-cluster-dns-operator-container-v4.7.0-0:202104292145.p0", "openshift-4.7::el8:ose-cluster-image-registry-operator-container-v4.7.0-0:202104302340.p0", "openshift-4.7::el8:ose-cluster-ingress-operator-container-v4.7.0-0:202104291920.p0", "openshift-4.7::el8:ose-cluster-openshift-apiserver-operator-container-v4.7.0-0:202105061841.p0", "openshift-4.7::el8:ose-cluster-update-keys-container-v4.7.0-0:202105060839.p0", "openshift-4.7::el8:ose-gcp-pd-csi-driver-operator-container-v4.7.0-0:202104290851.p0", "openshift-4.7::el8:ose-hello-openshift-container-v4.7.0-0:202105071232.p0", "openshift-4.7::el8:ose-insights-operator-container-v4.7.0-0:202105062344.p0", "openshift-4.7::el8:ose-installer-artifacts-container-v4.7.0-0:202105101449.p0", "openshift-4.7::el8:ose-installer-container-v4.7.0-0:202105101449.p0", "openshift-4.7::el8:ose-jenkins-agent-base-container-v4.7.0-0:202105062344.p0", "openshift-4.7::el8:ose-jenkins-agent-maven-container-v4.7.0-0:202105062344.p0", "openshift-4.7::el8:ose-jenkins-agent-nodejs-0:12-container-v4.7.0-202105062344.p0", "openshift-4.7::el8:ose-machine-api-operator-container-v4.7.0-0:202105071028.p0", "openshift-4.7::el8:ose-machine-config-operator-container-v4.7.0-0:202105111858.p0", "openshift-4.7::el8:ose-node-container-v4.7.0-0:202104280847.p0", "openshift-4.7::el8:ose-ovn-kubernetes-container-v4.7.0-0:202105071917.p0", "openshift-4.7::el8:ose-thanos-container-v4.7.0-0:202105061841.p0" ] } ], "threats": [ { "category": "impact", "details": "Moderate", "product_ids": [ "openshift-4.7.z:openshift4/ose-thanos-rhel8", "openshift-4.7::el8:cluster-etcd-operator-container-v4.7.0-0:202105072257.p0", "openshift-4.7::el8:cluster-network-operator-container-v4.7.0-0:202105071917.p0", "openshift-4.7::el8:driver-toolkit-container-v4.7.0-0:202105102252.p0", "openshift-4.7::el8:ironic-container-v4.7.0-0:202105111107.p0", "openshift-4.7::el8:kuryr-cni-container-v4.7.0-0:202105111940.p0", "openshift-4.7::el8:kuryr-controller-container-v4.7.0-0:202105111940.p0", "openshift-4.7::el8:openshift-enterprise-builder-container-v4.7.0-0:202105060839.p0", "openshift-4.7::el8:openshift-enterprise-console-container-v4.7.0-0:202105070703.p0", "openshift-4.7::el8:openshift-enterprise-hyperkube-container-v4.7.0-0:202105091821.p0", "openshift-4.7::el8:openshift-enterprise-tests-container-v4.7.0-0:202105110735.p0", "openshift-4.7::el8:openshift-jenkins-0:2-container-v4.7.0-202105071334.p0", "openshift-4.7::el8:operator-lifecycle-manager-container-v4.7.0-0:202104300003.p0", "openshift-4.7::el8:operator-registry-container-v4.7.0-0:202104292145.p0", "openshift-4.7::el8:ose-aws-machine-controllers-container-v4.7.0-0:202105010012.p0", "openshift-4.7::el8:ose-baremetal-installer-container-v4.7.0-0:202105101449.p0", "openshift-4.7::el8:ose-cloud-credential-operator-container-v4.7.0-0:202105061841.p0", "openshift-4.7::el8:ose-cluster-authentication-operator-container-v4.7.0-0:202105061754.p0", "openshift-4.7::el8:ose-cluster-config-operator-container-v4.7.0-0:202104291920.p0", "openshift-4.7::el8:ose-cluster-dns-operator-container-v4.7.0-0:202104292145.p0", "openshift-4.7::el8:ose-cluster-image-registry-operator-container-v4.7.0-0:202104302340.p0", "openshift-4.7::el8:ose-cluster-ingress-operator-container-v4.7.0-0:202104291920.p0", "openshift-4.7::el8:ose-cluster-openshift-apiserver-operator-container-v4.7.0-0:202105061841.p0", "openshift-4.7::el8:ose-cluster-update-keys-container-v4.7.0-0:202105060839.p0", "openshift-4.7::el8:ose-gcp-pd-csi-driver-operator-container-v4.7.0-0:202104290851.p0", "openshift-4.7::el8:ose-hello-openshift-container-v4.7.0-0:202105071232.p0", "openshift-4.7::el8:ose-insights-operator-container-v4.7.0-0:202105062344.p0", "openshift-4.7::el8:ose-installer-artifacts-container-v4.7.0-0:202105101449.p0", "openshift-4.7::el8:ose-installer-container-v4.7.0-0:202105101449.p0", "openshift-4.7::el8:ose-jenkins-agent-base-container-v4.7.0-0:202105062344.p0", "openshift-4.7::el8:ose-jenkins-agent-maven-container-v4.7.0-0:202105062344.p0", "openshift-4.7::el8:ose-jenkins-agent-nodejs-0:12-container-v4.7.0-202105062344.p0", "openshift-4.7::el8:ose-machine-api-operator-container-v4.7.0-0:202105071028.p0", "openshift-4.7::el8:ose-machine-config-operator-container-v4.7.0-0:202105111858.p0", "openshift-4.7::el8:ose-node-container-v4.7.0-0:202104280847.p0", "openshift-4.7::el8:ose-ovn-kubernetes-container-v4.7.0-0:202105071917.p0", "openshift-4.7::el8:ose-thanos-container-v4.7.0-0:202105061841.p0" ] } ], "title": "Egress Firewall does not reliably apply firewall rules" } ] }