Red Hat Security Advisory: OpenShift Container Platform 4.15.71 bug fix and security update

1. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

2. Architecture and Design

   For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…

3. Implementation · Input Validation

   Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).

OWASP Cheat Sheets

• Authorization (opens in a new tab)

OWASP ASVS 4.0.3

• V12.3.1 (opens in a new tab)

Attack patterns

• Path Traversal (opens in a new tab)
• Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
• Manipulating Web Input to File System Calls (opens in a new tab)
• Using Escaped Slashes in Alternate Encoding (opens in a new tab)
• Using Slashes in Alternate Encoding (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   Avoid using CRLF as a special sequence.

2. Implementation

   Appropriately filter or quote CRLF sequences in user-controlled input.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)
• Deserialization (opens in a new tab)
• Injection Prevention (opens in a new tab)
• SQL Injection Prevention (opens in a new tab)
• Injection Prevention in Java (opens in a new tab)

OWASP ASVS 4.0.3

• V1.5.1 (opens in a new tab)

Attack patterns

• Command Delimiters (opens in a new tab)
• Web Server Logs Tampering (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Implementation

   Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.

2. Implementation

   If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

OWASP Cheat Sheets

• Transport Layer Protection (opens in a new tab)
• TLS Cipher String (opens in a new tab)
• OWASP Authentication (opens in a new tab)

OWASP ASVS 4.0.3

• V9.2.1 (opens in a new tab)
• V1.9.2 (opens in a new tab)
• V2.8.5 (opens in a new tab)

Attack patterns

• Creating a Rogue Certification Authority Certificate (opens in a new tab)
• Signature Spoofing by Improper Validation (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   Choose a language that provides automatic memory management.

2. Implementation

   When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements · Language Selection

   Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

3. Operation · Build and Compilation · Environment Hardening

   Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   Change the code's logic so that the resource is only closed once. This might require simplifying or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple closes are buried within complex conditionals.

2. Implementation · Refactoring

   It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared when it is closed, and (3) checked before closing. This approach can be useful when there are disparate cases in which closes must be performed.

3. Implementation · Refactoring

   When closing a resource, set the resource's associated variable to NULL or equivalent value for the given language. Some APIs will ignore this null value without causing errors.

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).