CVE-2023-4456: Openshift-logging: lokistack authorisation is cached too broadly
A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.
Other sources
The opa-openshift component is responsible for authorizing the requests going to the LokiStack through the gateway. Requests are authenticated using a token and authorization happens by, among other things, checking for an RBAC privilege. To reduce the number of SubjectAccessReviews the result of the authorization is cached in opa-openshift for a while. Currently, the key used for this caching is just the token, which is too broad and allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw in openshift-logging LokiStack?
The vulnerability ID for this flaw is CVE-2023-4456.
What is the severity of CVE-2023-4456?
The severity of CVE-2023-4456 is medium with a CVSS score of 6.5.
What is the affected software for CVE-2023-4456?
The affected software for CVE-2023-4456 is Redhat Openshift Logging.
What is the impact of CVE-2023-4456?
CVE-2023-4456 allows a user with a valid token for one action to execute other actions as long as the authorization allowing the original action is still cached.
How can this vulnerability be fixed?
To fix CVE-2023-4456, it is recommended to update to the latest version of openshift-logging LokiStack.