4 results · Clear filters · Feed
-
Medium 5.7
Rhcl: sharedsecretref can be used to leak secrets severity
The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes those secretes are already in the kuadrant-system instead of copying it to the referred namespace. This creates space for a malicious actor with …
-
Medium 5.7
Rhcl: authorino denial of service through authpolicy with sharedsecretref severity
A Developer persona can bring down the Authorino service, preventing the evaluation of all AuthPolicies on the cluster
-
Medium 5.7
Rhcl: authpolicy callbacks result in denial of service in authorino severity
The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. I…
-
Medium 4.4
Cert-manager: potential dos when parsing specially crafted pem inputs
A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of…