CVE-2022-2403
First published: Tue Jun 28 2022(Updated: )
A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps, and accessible to any authenticated OpenShift user or service-account. A malicious user could exploit this flaw by reading the oauth-serving-cert ConfigMap in the openshift-config-managed namespace, compromising any web traffic secured using that certificate.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Openshift | >=4.9 |
Remedy
Removal of the private key from the ConfigMap, or modification of the RBAC permissions is not a sufficient mitigation on its own, as these will both be restored by the authentication-operator. This flaw can be mitigated by deploying a custom webhook which filters out the private key from the target ConfigMap, preventing it from being restored by the authentication-operator. An example of this can be found here: https://github.com/sfowl/configmap-cleaner After upgrading to a fixed version of OpenShift or applying the mitigation, all ingress certificates should be rotated: https://docs.openshift.com/container-platform/4.10/security/certificates/replacing-default-ingress-certificate.html#replacing-default-ingress
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2022-2403
- https://bugzilla.redhat.com/show_bug.cgi?id=2101959
- https://github.com/openshift/cluster-authentication-operator/pull/573
- https://access.redhat.com/errata/RHSA-2022:5664
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2107027
- https://access.redhat.com/errata/RHSA-2022:5879
- https://access.redhat.com/security/cve/cve-2022-2403
- https://www.cve.org/CVERecord?id=CVE-2022-2403 https://nvd.nist.gov/vuln/detail/CVE-2022-2403
Frequently Asked Questions
What is the severity of CVE-2022-2403?
The severity of CVE-2022-2403 is high with a severity value of 7.7.
How can a malicious user exploit CVE-2022-2403?
A malicious user can exploit CVE-2022-2403 by reading the incorrectly stored private key for the external cluster certificate.
What is the affected software for CVE-2022-2403?
The affected software for CVE-2022-2403 is Red Hat OpenShift Container Platform version 4.9 and later.
How can I fix CVE-2022-2403?
To fix CVE-2022-2403, update to the latest version of the OpenShift Container Platform and follow the guidance provided by Red Hat.
Are there any references available for CVE-2022-2403?
Yes, you can find references for CVE-2022-2403 at the following links: [link1](https://github.com/openshift/cluster-authentication-operator/pull/573), [link2](https://access.redhat.com/errata/RHSA-2022:5664), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2107027).
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-2403
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/remedy
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- vendor/redhat
- canonical/redhat openshift
- version/redhat openshift/4.9