5.3
Medium
CVE-2024-6535 A flaw was found in Skupper
Description
A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an attacker to bypass authentication to the Skupper console via a specially-crafted cookie.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Service Interconnect 1.4 for RHEL 9 1.4 | earliest → < 1.4.7-1 | 1.4.7-1 |
| Service Interconnect 1 for RHEL 9 1.5 | earliest → < 1.5.5-1 | 1.5.5-1 |
| Red Hat Service Interconnect 1 | Versions not published |
References
- RHSA-2024:4865 access.redhat.com
- RHSA-2024:4871 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2296024 bugzilla.redhat.com
Timeline
- Published
- Last modified