6.5
Medium
CVE-2024-7079 A flaw was found in the Openshift console
Description
A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithUser() middleware function. Contrary to its name, this middleware function does not verify the validity of the user's credentials. As a result, unauthenticated users can access this endpoint.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2299678 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat OpenShift Container Platform 3.11
The 18 CVEs of Red Hat OpenShift Container Platform 3.11 →
CVE-2024-7631
Openshift-console: openshift console: path traversal
4.3
Medium
CVE-2024-11831
Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
5.4
Medium
CVE-2024-8676
Cri-o: checkpoint restore can be triggered from different namespaces
7.4
High
CVE-2024-3056
Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack
7.7
High