9.0
Critique
CVE-2025-12548 A flaw was found in Eclipse Che che-machine-exec
Description
A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.22 3.22 | premières → < 3.22.1-1763525702 | 3.22.1-1763525702 |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 3.23 | premières → < 3.23.1-1763508770 | 3.23.1-1763508770 |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 3.24 | premières → < 3.24.1-1763547630 | 3.24.1-1763547630 |
| Red Hat OpenShift Dev Spaces | Versions non publiées |
Références
- RHSA-2025:22620 access.redhat.com
- RHSA-2025:22623 access.redhat.com
- RHSA-2025:22652 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2408850 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification