8.5
Élevée
CVE-2026-49332 A flaw was found in openshift/oauth-proxy
Description
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Versions non publiées | |
| Red Hat OpenShift Container Platform 4.21 1785851359 | premières → < 1785851359 | 1785851359 |
| Red Hat OpenShift Container Platform 4.20 1785833742 | premières → < 1785833742 | 1785833742 |
| Red Hat OpenShift Container Platform 4.22 1785885351 | premières → < 1785885351 | 1785885351 |
| Red Hat OpenShift Container Platform 4.18 1785529735 | premières → < 1785529735 | 1785529735 |
| Red Hat OpenShift Container Platform 4.19 1785521728 | premières → < 1785521728 | 1785521728 |
| Red Hat OpenShift Container Platform 4.14 1785549818 | premières → < 1785549818 | 1785549818 |
| Red Hat OpenShift Container Platform 4.16 1785544039 | premières → < 1785544039 | 1785544039 |
| Red Hat OpenShift Container Platform 4.2 1785833742 | premières → < 1785833742 | 1785833742 |
Afficher les 4 autres branches Masquer les 4 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Container Platform 4.12 1786458704 | premières → < 1786458704 | 1786458704 |
| Red Hat OpenShift Container Platform 4.13 1786477436 | premières → < 1786477436 | 1786477436 |
| Red Hat OpenShift Container Platform 4.15 1787054100 | premières → < 1787054100 | 1787054100 |
| Red Hat OpenShift Container Platform 4.17 1787543313 | premières → < 1787543313 | 1787543313 |
Références
- RHSA-2026:50681 access.redhat.com
- RHSA-2026:50758 access.redhat.com
- RHSA-2026:51007 access.redhat.com
- RHSA-2026:51013 access.redhat.com
- RHSA-2026:51022 access.redhat.com
- RHSA-2026:51025 access.redhat.com
- RHSA-2026:51038 access.redhat.com
- RHSA-2026:54188 access.redhat.com
- RHSA-2026:54206 access.redhat.com
- RHSA-2026:56912 access.redhat.com
- RHSA-2026:60023 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2483253 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat OpenShift Container Platform 4
Les 629 CVE de Red Hat OpenShift Container Platform 4 →
CVE-2026-82976
Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret
7.1
Élevée
CVE-2026-120831
Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
6.5
Moyenne
CVE-2026-120830
Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure
7.4
Élevée
CVE-2026-120194
Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step
7.5
Élevée