CVE-2023-3361: S3 credentials included when exporting elyra notebook
A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output instead of an ID for a Kubernetes secret.
Other sources
Exporting a pipeline from RHODS Elyra notebook pipeline editor as Python DSL or YAML reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this flaw in Red Hat OpenShift Data Science?
The vulnerability ID is CVE-2023-3361.
What is the severity rating of CVE-2023-3361?
The severity rating of CVE-2023-3361 is high with a value of 7.5.
How does the vulnerability in Red Hat OpenShift Data Science affect the software?
The vulnerability affects Red Hat OpenShift Data Science, specifically the version 1.28.1 of the odh-dashboard package.
What is the root cause of this vulnerability in Red Hat OpenShift Data Science?
The vulnerability occurs when exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, which saves S3 credentials in plain text instead of an ID for a Kubernetes secret.
Is there a fix available for this vulnerability in Red Hat OpenShift Data Science?
Yes, the fix for this vulnerability is available in version 1.28.1 of the odh-dashboard package.