Denial of Service (DoS)
CVE: CVE-2018-17419
Component: dns
CWE: CWE-476
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-01-01T00:00:00+00:00

The Miek Gieben DNS library is vulnerable to a denial of service caused by a segmentation violation in setTA in scan_rr.go. By persuading a victim to open a specially-crafted file, a remote attacker can cause the application to crash.

Statement: The opportunity for a denial of service is limited to the golang runtime. In the case of the OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang’s Garbage Collector; OpenShift’s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.

Remediation:
For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are

(For x86_64 architecture)
The image digest is sha256:e5eb60f6b35acafb3fcc9648d5a812f41df4645d4f345322ecf709a450004cef

(For s390x architecture)
The image digest is sha256:0a118768fe192c70e62278457c7f9d5e9e93f4b0ac131058ff52a916e80301e0

(For ppc64le architecture)
The image digest is sha256:38ddabb4097428af30338bb380a4845a1d69d720a01745595d543762227572c2

(For aarch64 architecture)
The image digest is sha256:d2b1c47c127ece382c81c2c000e5ad356657af3894d610b193a4051ba259bf92

All OpenShift Container Platform 4.10 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html

You can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are:

(For x86_64 architecture)
The image digest is sha256:518177a34452837920f1e77944f6afa08864537260c9f742b8c88b6157e4f901

(For s390x architecture)
The image digest is sha256:c8f1891f3d4a93104a209b96987e07e2077b685238a246da12a656bf69be88c3

(For ppc64le architecture)
The image digest is sha256:19ad52422acbd24dde71ae5089471c541004e1c0bf4e13e081e5b65220600c15

(For aarch64 architecture)
The image digest is sha256:d87fcd39ad6fad29454ff9137ce521d7049cda2b391ccbdd34554427d60bd27b

All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are:

(For x86_64 architecture)
The image digest is sha256:41fd42cc8b9f86fc86cc8763dcf27e976299ff632a336d393b8e643bd8a5f967

(For s390x architecture)
The image digest is sha256:13666e036043e0d2283890259861a8b8132e6afc818973a2f8bab28d9947cd94

(For ppc64le architecture)
The image digest is sha256:00b61dd3ae8d8da28eb7a5385eb1c7f200efa73023e44b1c220a7d041ca1bad1

(For aarch64 architecture)
The image digest is sha256:3d73e42724be8f53f8511df17ef900225305226d37397ffde3385cbc6c55a132

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are:

(For x86_64 architecture)
The image digest is sha256:9c92b5ec203ee7f81626cc4e9f02086484056a76548961e5895916f136302b1f

(For s390x architecture)
The image digest is sha256:dbc768473b99538c15a35ea1be7ff656a6ac01e5001af4fac117c51f461c6054

(For ppc64le architecture)
The image digest is sha256:dc4bab40680fb4ed84665abc34aefef5e0689eafef1c878776c3685ddaa759d5

(For aarch64 architecture)
The image digest is sha256:5415fb0c33370014b9be83bc3120cc9d35a95922b2e93e218cac603e4179717a

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:e2c70fca183e380c6121a1c847806f11e839482123277235a8579db472b9ccf2

      (For s390x architecture)
      The image digest is sha256:bfb67b8051cd35eac7d35bc7b190a5bedd33ab4ce90c9935b5d5ac59f85c03a2

      (For ppc64le architecture)
      The image digest is sha256:b974830f0dc0fef0673a04c13bf24cbbeca2dfaf3c488de77f9dfa8169c74cdb

      (For aarch64 architecture)
      The image digest is sha256:19f4307a81793f66a4b810bb1e3a5037269b5b03397d0d5aa3206f883f991664

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.