Description
An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | openshift-console | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/openshift/console | <= 6.0.6 | — | GHSA-4crf-28c7-v4gr |
| Go | github.com/openshift/console | all versions | — | GO-2024-3083 |
Advisories 1
- WID-SEC-2024-1892 Red Hat OpenShift: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jan 8, 2025
References
- RHSA-2024:10813 vendor-advisory
- RHSA-2024:6122 vendor-advisory
- RHSA-2024:7922 vendor-advisory
- RHSA-2024:8415 vendor-advisory
- RHSA-2024:8991 vendor-advisory
- RHSA-2024:9620 vendor-advisory
- RHSA-2025:0014 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-6508 vdb-entry
- RHBZ#2295777 issue-tracking