What OpenShift Online and OpenShift Dedicated customers should know about the recently announced vulnerability of runc/docker/CRI-O
On February 11th, 2019, details of a vulnerability that researchers have confirmed is present on certain versions of runc (impacting docker and CRI-O) was published. These tools are deployed as part of the OpenShift product and impact the Red Hat OpenShift hosted properties.
The Starter and Pro tiers are affected by the vulnerability, but known exploits are mitigated by the SELinux configuration deployed on cluster nodes. As soon as the patched runc, docker, and/or CRI-O code is available, the SRE team will update the cluster infrastructure.
The OSD environment is also affected by the vulnerability, but known exploits are mitigated by the SELinux configuration deployed to cluster nodes. The SRE team will update the cluster infrastructure as soon as the patched runc and docker code is available. OSD customers will be communicated to separately regarding cluster remediation.
CVE details: https://access.redhat.com/security/cve/cve-2019-5736
Public announcement: https://seclists.org/oss-sec/2019/q1/119