Description
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | cluster-monitoring-operator | ≤ 0.1.1 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/openshift/cluster-monitoring-operator | all versions | — | GO-2024-2789 |
Advisories 1
- WID-SEC-2024-1019 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 16, 2024
References
- RHSA-2024:1887 vendor-advisory
- RHSA-2024:1891 vendor-advisory
- RHSA-2024:2047 vendor-advisory
- RHSA-2024:2782 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-1139 vdb-entry
- RHBZ#2262158 issue-tracking