Skip to content
OpenAdvisories
Medium WID-SEC-2024-1718 2 CVEs

Red Hat OpenShift (GitOps): Schwachstelle ermöglicht Denial of Service

Published Jul 28, 2024 · Updated Aug 1, 2024 · Revision 3 · de-DE

Vendor: Red Hat Product: Enterprise Linux Product: openshift

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.

Vulnerabilities 2

  • High 7.5
    CVE-2024-40634

    Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessiv…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • Medium 4.7
    CVE-2023-40025

    Argo CD web terminal session doesn't expire

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go

Revision history

  1. #3

    Neue Updates von Red Hat aufgenommen

  2. #2

    Produktversion angepasst

  3. #1

    Initiale Fassung

References