6.5
Moyenne
CVE-2024-7079 A flaw was found in the Openshift console
Description
A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithUser() middleware function. Contrary to its name, this middleware function does not verify the validity of the user's credentials. As a result, unauthenticated users can access this endpoint.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Versions non publiées | |
| Red Hat OpenShift Container Platform 4 | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2299678 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat OpenShift Container Platform 3.11
Les 18 CVE de Red Hat OpenShift Container Platform 3.11 →
CVE-2024-7631
Openshift-console: openshift console: path traversal
4.3
Moyenne
CVE-2024-11831
Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
5.4
Moyenne
CVE-2024-8676
Cri-o: checkpoint restore can be triggered from different namespaces
7.4
Élevée
CVE-2024-3056
Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack
7.7
Élevée