CVE-2023-3361: S3 credentials included when exporting elyra notebook
First published: Wed Jun 21 2023(Updated: )
A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output instead of an ID for a Kubernetes secret.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Opendatahub Open Data Hub Dashboard | <1.28.1 | |
| Redhat Openshift Data Science | ||
| redhat/odh-dashboard | <1.28.1 | 1.28.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this flaw in Red Hat OpenShift Data Science?
The vulnerability ID is CVE-2023-3361.
What is the severity rating of CVE-2023-3361?
The severity rating of CVE-2023-3361 is high with a value of 7.5.
How does the vulnerability in Red Hat OpenShift Data Science affect the software?
The vulnerability affects Red Hat OpenShift Data Science, specifically the version 1.28.1 of the odh-dashboard package.
What is the root cause of this vulnerability in Red Hat OpenShift Data Science?
The vulnerability occurs when exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, which saves S3 credentials in plain text instead of an ID for a Kubernetes secret.
Is there a fix available for this vulnerability in Red Hat OpenShift Data Science?
Yes, the fix for this vulnerability is available in version 1.28.1 of the odh-dashboard package.
- collector/nvd-api
- collector/nvd-index
- agent/type
- agent/author
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/title
- agent/severity
- agent/weakness
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-3361
- agent/software-canonical-lookup
- agent/event
- agent/tags
- vendor/opendatahub
- canonical/opendatahub open data hub dashboard
- vendor/redhat
- canonical/redhat openshift data science
- package-manager/redhat