Skip to content
OpenAdvisories
Medium WID-SEC-2024-0812 5 CVEs

Red Hat OpenShift: Mehrere Schwachstellen

Published Apr 8, 2024 · Updated Apr 10, 2024 · Revision 2 · de-DE

Vendor: Red Hat Product: Enterprise Linux Product: openshift Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen oder um Sicherheitsmaßnahmen zu umgehen.

Product

Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.

Vulnerabilities 5

  • Critical 9.8
    CVE-2024-21652

    Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effecti…

    argoproj Argo CD github.com/argoproj/argo-cd/v2 Go
  • High 7.5
    CVE-2024-21661

    Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a critical flaw in the application to initiate a Denial of Service (DoS) attack, rendering the application inoperabl…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • High 7.5
    CVE-2024-21662

    Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. Th…

    argoproj Argo CD
  • Medium 6.5
    CVE-2024-29893

    Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the …

    argoproj Argo CD github.com/argoproj/argo-cd/v2 Go
  • Medium 6.4
    CVE-2023-50726

    Users with `create` but not `override` privileges can perform local sync in argo-cd

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limit…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go

Revision history

  1. #2

    Neue Updates von Red Hat aufgenommen

  2. #1

    Initiale Fassung

References