Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen und Dateimanipulation

Summary

Product

Vulnerabilities 2

• High 8.1
  CVE-2024-5154

  Cri-o: malicious container can create symlink on host

  A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat OpenShift Container Platform 4.14 Linux Go
  Jun 12, 2024
• Medium 6.0
  CVE-2023-30841

  Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps

  Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of…

  metal3-io baremetal-operator github.com/metal3-io/baremetal-operator Go
  Apr 26, 2023

Revision history

1. 2024-12-10 #5

   Neue Updates von Red Hat aufgenommen

2. 2024-07-16 #4

   Neue Updates von Red Hat aufgenommen

3. 2024-06-26 #3

   Neue Updates von Red Hat aufgenommen

4. 2024-06-12 #2

   Neue Updates von Red Hat aufgenommen

5. 2024-06-11 #1

   Initiale Fassung

References

• Red Hat Security Advisory vom 2024-06-11
  https://access.redhat.com/errata/RHSA-2024:3676
• Red Hat Security Advisory vom 2024-06-11
  https://access.redhat.com/errata/RHSA-2024:3801
• Red Hat Security Advisory RHSA-2024:3700 vom 2024-06-13
  https://access.redhat.com/errata/RHSA-2024:3700
• Red Hat Security Advisory RHSA-2024:4008 vom 2024-06-27
  https://access.redhat.com/errata/RHSA-2024:4008
• Red Hat Security Advisory RHSA-2024:4486 vom 2024-07-17
  https://access.redhat.com/errata/RHSA-2024:4486
• Red Hat Security Advisory RHSA-2024:10818 vom 2024-12-11
  https://access.redhat.com/errata/RHSA-2024:10818