5.7
Medium
CVE-2023-4456 A flaw was found in openshift-logging LokiStack
Description
A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RHOL-5.5-RHEL-8 0.1 | earliest → < 0.1.0-327 | 0.1.0-327 |
| RHOL-5.6-RHEL-8 0.1 | earliest → < 0.1.0-326 | 0.1.0-326 |
| RHOL-5.7-RHEL-8 0.1 | earliest → < 0.1.0-325 | 0.1.0-325 |
References
- RHSA-2023:4933 access.redhat.com
- RHSA-2023:5095 access.redhat.com
- RHSA-2023:5096 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2233087 bugzilla.redhat.com
Timeline
- Published
- Last modified