Skip to content
OpenAdvisories
High WID-SEC-2023-0201 2 CVEs

Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Published Jan 25, 2023 · Updated Jan 25, 2023 · de-DE

Vendor: Red Hat Product: openshift Product: OpenShift < GitOps 1.5.9 Product: OpenShift < GitOps 1.6.4 Product: OpenShift < GitOps 1.7 Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Product

Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.

Vulnerabilities 2

  • Critical 9.1
    CVE-2023-22482

    JWT audience claim is not verified

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3 are vulnerable to an improper authorization bug causing the API to accept certain invalid tok…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • High 8.6
    CVE-2023-22736

    argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applicat…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go

Revision history

  1. #1

    Initiale Fassung

References