Summary
Ein entfernter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Informationen offenzulegen oder um Sicherheitsmaßnahmen zu umgehen.
Product
Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.
Vulnerabilities 3
-
High 7.7
Cluster-monitoring-operator: credentials leak
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
-
Medium 6.5
Kubevirt-csi: persistentvolume allows access to hcp's root node
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches t…
-
Low 2.6
OpenShift OSIN CheckClientSecret timing discrepancy
A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 86126…
Revision history
-
#2
Neue Updates von Red Hat aufgenommen
-
#1
Initiale Fassung
References
-
RedHat Security Advisory vom 2024-05-02
https://access.redhat.com/errata/RHSA-2024:2047
-
Red Hat Security Advisory RHSA-2024:2782 vom 2024-05-16
https://access.redhat.com/errata/RHSA-2024:2782