Description
A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | github.com/netobserv/network-observability-console-plugin | — | — |
| Red Hat | NETWORK-OBSERVABILITY-1.1.0-RHEL-8 | — | — |
Advisories 1
- WID-SEC-2023-0396 Red Hat OpenShift Network observability: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Feb 15, 2023
References
- RHSA-2023:0786 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-0813 vdb-entry
- RHBZ#2169468 issue-tracking