Skip to content
OpenAdvisories
High WID-SEC-2023-2296 2 CVEs

Red Hat OpenShift: Mehrere Schwachstellen

Published Sep 10, 2023 · Updated Sep 17, 2023 · Revision 2 · de-DE

Vendor: Red Hat Product: openshift Product: OpenShift GitOps < 1.8.5 Product: OpenShift GitOps < 1.9.2 Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.

Product

Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.

Vulnerabilities 2

  • Critical 9.9
    CVE-2023-40029 Public exploit

    Cluster secret might leak in cluster details page in Argo CD

    Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. p…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • Medium 6.5
    CVE-2023-40584

    Denial of Service to Argo CD repo-server

    Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-con…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go

Revision history

  1. #2

    Präzisierung betroffene Versionen

  2. #1

    Initiale Fassung

References